Lennart Poettering [Thu, 7 Jan 2016 15:13:14 +0000 (16:13 +0100)]
Merge pull request #2284 from teg/resolved-cname-2
resolved: query_process_cname - make fully recursive
Tom Gundersen [Thu, 7 Jan 2016 14:05:58 +0000 (15:05 +0100)]
Merge pull request #2276 from poettering/dnssec12
Twelfth DNSSEC PR
Tom Gundersen [Tue, 5 Jan 2016 16:56:45 +0000 (17:56 +0100)]
resolved: query_process_cname - make fully recursive
This ensures we properly resolve the CNAME chain as far as we can, rather
than only CNAME chains of length one.
Daniel Mack [Thu, 7 Jan 2016 11:02:38 +0000 (12:02 +0100)]
Merge pull request #2283 from evverx/update-valgrind-tests
build-sys: valgrind-tests: exclude python scripts too
Evgeny Vereshchagin [Thu, 7 Jan 2016 10:01:45 +0000 (10:01 +0000)]
build-sys: valgrind-tests: exclude python scripts too
Lennart Poettering [Wed, 6 Jan 2016 17:39:08 +0000 (18:39 +0100)]
update DNSSEC TODO
Lennart Poettering [Wed, 6 Jan 2016 17:36:32 +0000 (18:36 +0100)]
resolved: introduce support for per-interface negative trust anchors
Daniel Mack [Wed, 6 Jan 2016 13:56:14 +0000 (14:56 +0100)]
nspawn: fix two typos in error messages
On errors, mention the functions that really failed.
Daniel Mack [Wed, 6 Jan 2016 12:53:29 +0000 (13:53 +0100)]
Merge pull request #2137 from fbuihuu/fstab-gen-fix-device-timeout
Fstab gen fix device timeout
Daniel Mack [Wed, 6 Jan 2016 12:36:15 +0000 (13:36 +0100)]
Merge pull request #2261 from evverx/fix-test-rlimit-util
tests: don't change hard limit in test-rlimit-util
Daniel Mack [Wed, 6 Jan 2016 11:56:56 +0000 (12:56 +0100)]
Merge pull request #2243 from evverx/add-regression-test-for-journald-restart
tests: add regression test for `systemctl restart systemd-journald`
Daniel Mack [Wed, 6 Jan 2016 11:10:22 +0000 (12:10 +0100)]
Merge pull request #2273 from evverx/fix-possible-lost-in-test-bus-cleanup
tests: use sd_bus_flush_close_unref instead of sd_bus_unref in test-bus-cleanup
Daniel Mack [Wed, 6 Jan 2016 11:09:43 +0000 (12:09 +0100)]
Merge pull request #2278 from systemd-mailing-devs/
1452047873-6043-1-git-send-email-hui.wang@canonical.com
keymap: remap microphone mute keycode for Lenovo Thinkcentre M800z
Hui Wang [Wed, 6 Jan 2016 02:37:53 +0000 (10:37 +0800)]
keymap: remap microphone mute keycode for Lenovo Thinkcentre M800z
This Lenovo machine use codec Line2 to implement a microphone mute
button, it depends on the unsolicited interrupt to generate key event,
the scan code for this button is assigned to 0x00 in the linux kernel
driver, and the keycode is KEY_MICMUTE(248), we need to remap this
keycode to KEY_F20 to make this hotkey work in X11.
BugLink: https://bugs.launchpad.net/bugs/1531362
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Lennart Poettering [Wed, 6 Jan 2016 00:01:00 +0000 (01:01 +0100)]
resolved: when dumping the NTA database, sort output
Now that we populate the trust database by default with a larger number
of entires, we better make sure to output a more readable version.
Lennart Poettering [Tue, 5 Jan 2016 23:59:51 +0000 (00:59 +0100)]
resolved: populate negative trust anchor by default
Let's increase compatibility with many private domains by default, and
ship a default NTA list of wel-known private domains, where it is
unlikely they will be deployed as official TLD anytime soon.
Lennart Poettering [Tue, 5 Jan 2016 23:59:32 +0000 (00:59 +0100)]
resolved: log all OOM errors
Lennart Poettering [Tue, 5 Jan 2016 23:58:26 +0000 (00:58 +0100)]
resolved: reuse dns_trust_anchor_knows_domain() at another location
Lennart Poettering [Tue, 5 Jan 2016 23:57:21 +0000 (00:57 +0100)]
resolved: count unsupported dnssec algorithm as indeterminate RRset
After all, when we don't support the algorithm we cannot determine
validity.
Lennart Poettering [Tue, 5 Jan 2016 21:13:56 +0000 (22:13 +0100)]
resolved: try to detect fritz.box-style private DNS zones, and downgrade to non-DNSSEC mode for them
This adds logic to detect cases like the Fritz!Box routers which serve
a private DNS domain "fritz.box" under the TLD "box" that does not
exist in the root servers. If this is detected DNSSEC validation is
turned off for this private domain, thus improving compatibility with
such private DNS zones.
This should be fairly secure as we first rely on the proof that .box
does not exist before this logic is applied. Nevertheless the logic is
only enabled for DNSSEC=allow-downgrade mode.
This logic does not work for routers that set up a full DNS zone directly
under a non-existing TLD, as in that case we cannot prove
that the domain is truly non-existing according to the root servers.
Lennart Poettering [Tue, 5 Jan 2016 19:27:29 +0000 (20:27 +0100)]
resolved: when dumping trust anchor contents, clarify when it is empty
Lennart Poettering [Tue, 5 Jan 2016 19:26:35 +0000 (20:26 +0100)]
resolved: fix DNSSEC transaction dependency recursion check
We followed the wrong connection. This only worked sometimes at all, because we
also return the wrong error code.
Lennart Poettering [Tue, 5 Jan 2016 18:59:19 +0000 (19:59 +0100)]
update DNSSEC TODO
Lennart Poettering [Tue, 5 Jan 2016 18:57:33 +0000 (19:57 +0100)]
resolved,networkd: add a per-interface DNSSEC setting
This adds a DNSSEC= setting to .network files, and makes resolved honour
them.
Lennart Poettering [Tue, 5 Jan 2016 18:43:51 +0000 (19:43 +0100)]
resolved: log about per-interface setting parse errors
Lennart Poettering [Tue, 5 Jan 2016 18:42:34 +0000 (19:42 +0100)]
resolved: properly release all DnsServers that belong to a link
Lennart Poettering [Tue, 5 Jan 2016 16:44:16 +0000 (17:44 +0100)]
resolved: rename "downgrade-ok" mode to "allow-downgrade"
After discussing this with Tom, we figured out "allow-downgrade" sounds
nicer.
Lennart Poettering [Tue, 5 Jan 2016 16:40:51 +0000 (17:40 +0100)]
man: document that DNS= and Domains= is implemented by resolved
Lennart Poettering [Tue, 5 Jan 2016 16:37:09 +0000 (17:37 +0100)]
resolved: make MulticastDNS support configurable in resolved.conf
The option is already there, but wasn't exported in the configuration
file so far. Fix that.
Lennart Poettering [Tue, 5 Jan 2016 16:32:25 +0000 (17:32 +0100)]
networkd,resolved: add a per-interface mdns configuration option
Lennart Poettering [Tue, 5 Jan 2016 16:25:10 +0000 (17:25 +0100)]
resolved,networkd: unify ResolveSupport enum
networkd previously knew an enum "ResolveSupport" for configuring
per-interface LLMNR support, resolved had a similar enum just called
"Support", with the same value and similar pasers.
Unify this, call the enum ResolveSupport, and port both daemons to it.
Lennart Poettering [Tue, 5 Jan 2016 16:10:17 +0000 (17:10 +0100)]
basic: add string table macros for "extended boolean" enums
In a couple of cases we maintain configuration settings that know an on
and off state, like a boolean, plus some additional states. We generally
parse them as booleans first, and if that fails check for specific
additional values.
This adds a generalized set of macros for parsing such settings, and
ports one use in resolved and another in networkd over to it.
Lennart Poettering [Tue, 5 Jan 2016 15:43:07 +0000 (16:43 +0100)]
sd-network: unify parsing of /run/systemd/netif/links/* string fields
Lennart Poettering [Tue, 5 Jan 2016 15:42:40 +0000 (16:42 +0100)]
man: fix a few typos
Lennart Poettering [Tue, 5 Jan 2016 15:40:29 +0000 (16:40 +0100)]
Merge pull request #2272 from kinvolk/alban/typos
machine: fix typo: MS_MOUNT does not exist
Evgeny Vereshchagin [Tue, 5 Jan 2016 15:35:23 +0000 (15:35 +0000)]
tests: use sd_bus_flush_close_unref instead of sd_bus_unref in test-bus-cleanup
Fixes:
$ make valgrind-tests TESTS=test-bus-cleanup
==6363== 9 bytes in 1 blocks are possibly lost in loss record 1 of 28
==6363== at 0x4C2BBCF: malloc (vg_replace_malloc.c:299)
==6363== by 0x197D12: hexmem (hexdecoct.c:79)
==6363== by 0x183083: bus_socket_start_auth_client (bus-socket.c:639)
==6363== by 0x1832A0: bus_socket_start_auth (bus-socket.c:678)
==6363== by 0x183438: bus_socket_connect (bus-socket.c:705)
==6363== by 0x14B0F2: bus_start_address (sd-bus.c:1053)
==6363== by 0x14B592: sd_bus_start (sd-bus.c:1134)
==6363== by 0x14B95E: sd_bus_open_system (sd-bus.c:1235)
==6363== by 0x1127E2: test_bus_open (test-bus-cleanup.c:42)
==6363== by 0x112AAE: main (test-bus-cleanup.c:87)
==6363==
...
$ ./libtool --mode=execute valgrind ./test-bus-cleanup
==6584== LEAK SUMMARY:
...
==6584== possibly lost: 10,566 bytes in 27 blocks
Alban Crequy [Tue, 5 Jan 2016 15:07:33 +0000 (16:07 +0100)]
machine: fix typo: MS_MOUNT does not exist
Tom Gundersen [Tue, 5 Jan 2016 14:47:15 +0000 (15:47 +0100)]
Merge pull request #2269 from poettering/dnssec11
Eleventh DNSSEC patch set
Lennart Poettering [Tue, 5 Jan 2016 13:20:27 +0000 (14:20 +0100)]
man: add documentation for dnssec-trust-anchors.d(5)
Lennart Poettering [Tue, 5 Jan 2016 13:19:05 +0000 (14:19 +0100)]
resolved: also skip built-in trust anchor addition of there's a DNSKEY RR for the root domain defined
We already skip this when the trust anchor files define a DS RR for the
root domain, now also skip it if there's a DNSKEY RR.
Lennart Poettering [Tue, 5 Jan 2016 13:18:18 +0000 (14:18 +0100)]
resolved: move trust anchor files to /etc/dnssec-trust-anchors.d/
These files are not specific to resolved really, and this is then more
in-line with how /etc/sysctl.d and suchlike is handled.
Lennart Poettering [Tue, 5 Jan 2016 11:51:14 +0000 (12:51 +0100)]
Merge pull request #2205 from pohly/cgroup-smack-run-label
mount-setup.c: fix handling of symlink Smack labelling in cgroup setup
Patrick Ohly [Mon, 21 Dec 2015 13:56:00 +0000 (14:56 +0100)]
mount-setup.c: fix handling of symlink Smack labelling in cgroup setup
The code introduced in
f8c1a81c51 (= systemd 227) failed for me with:
Failed to copy smack label from net_cls to /sys/fs/cgroup/net_cls: No such file or directory
There is no need for a symlink in this case because source and target
are identical. The symlink() call is allowed to fail when the target
already exists. When that happens, copying the Smack label must be
skipped.
But the code also failed when there is a symlink, like "cpu ->
cpu,cpuacct", because mac_smack_copy() got called with
src="cpu,cpuacct" which fails to find the entry because the current
directory is not inside /sys/fs/cgroup. The absolute path to the existing
entry must be used instead.
Lennart Poettering [Tue, 5 Jan 2016 00:42:04 +0000 (01:42 +0100)]
Merge pull request #2268 from whot/hwdb-updates
hwdb: add axis ranges and resolution for Dell Lattitude E6220
Lennart Poettering [Tue, 5 Jan 2016 00:35:28 +0000 (01:35 +0100)]
resolved: when caching negative responses, honour NSEC/NSEC3 TTLs
When storing negative responses, clamp the SOA minimum TTL (as suggested
by RFC2308) to the TTL of the NSEC/NSEC3 RRs we used to prove
non-existance, if it there is any.
This is necessary since otherwise an attacker might put together a faked
negative response for one of our question including a high-ttl SOA RR
for any parent zone, and we'd use trust the TTL.
Lennart Poettering [Mon, 4 Jan 2016 23:31:32 +0000 (00:31 +0100)]
man: add basic documentation for resolved.conf's DNSSEC= switch
Peter Hutterer [Mon, 4 Jan 2016 03:54:11 +0000 (13:54 +1000)]
hwdb: add axis ranges and resolution for Dell Lattitude E6220
https://bugzilla.redhat.com/show_bug.cgi?id=1293576
Lennart Poettering [Mon, 4 Jan 2016 21:43:25 +0000 (22:43 +0100)]
update DNSSEC TODO
Lennart Poettering [Mon, 4 Jan 2016 21:35:54 +0000 (22:35 +0100)]
resolved: explicitly handle case when the trust anchor is empty
Since we honour RFC5011 revoked keys it might happen we end up with an
empty trust anchor, or one where there's no entry for the root left.
With this patch the logic is changed what to do in this case.
Before this patch we'd end up requesting the root DS, which returns with
NODATA but a signed NSEC we cannot verify, since the trust anchor is
empty after all. Thus we'd return a DNSSEC result of "missing-key", as
we lack a verified version of the key.
With this patch in place, look-ups for the root DS are explicitly
recognized, and not passed on to the DNS servers. Instead, if
downgrade-ok mode is on an unsigned NODATA response is synthesized, so
that the validator code continues under the assumption the root zone was
unsigned. If downgrade-ok mode is off a new transaction failure is
generated, that makes this case recognizable.
Lennart Poettering [Mon, 4 Jan 2016 21:35:17 +0000 (22:35 +0100)]
resolved: introduce a proper bus error for DNSSEC validation errors
Lennart Poettering [Mon, 4 Jan 2016 21:25:38 +0000 (22:25 +0100)]
resolved: explicitly avoid cyclic transaction dependencies
We already try hard not to create cyclic transaction dependencies, where
a transaction requires another one for DNSSEC validation purposes, which
in turn (possibly indirectly) pulls in the original transaction again,
thus resulting in a cyclic dependency and ultimately a deadlock since
each transaction waits for another one forever.
So far we wanted to avoid such cyclic dependencies by only going "up the
tree" when requesting auxiliary RRs and only going from one RR type to
another, but never back. However this turned out to be insufficient.
Consider a domain that publishes one or more DNSKEY but which has no DS
for it. A request for the domain's DNSKEY triggers a request for the
domain's DS, which will then fail, but return an NSEC, signed by the
DNSKEY. To validate that we'd request the DNSKEY again. Thus a DNSKEY
request results in a DS request which results in the original DNSKEY
request again. If the original lookup had been a DS lookup we'd end up
in the same cyclic dependency, hence we cannot statically break one of
them, since both requests are of course fully valid. Hence, do full
cyclic dependency checking: each time we are about to add a dependency
to a transaction, check if the transaction is already a dependency of
the dependency (recursively down the tree).
Lennart Poettering [Mon, 4 Jan 2016 21:22:47 +0000 (22:22 +0100)]
resolved: block transaction GC'ing while dns_transaction_request_dnssec_keys() is running
If any of the transactions started by
dns_transaction_request_dnssec_keys() finishes promptly without
requiring asynchronous operation this is reported back to the issuing
transaction from the same stackframe. This might ultimately result in
this transaction to be freed while we are still in its
_request_dnssec_keys() stack frame. To avoid memory corruption block the
transaction GC while in the call, and manually issue a GC after it
returned.
Lennart Poettering [Mon, 4 Jan 2016 19:50:07 +0000 (20:50 +0100)]
update RFCs
Lennart Poettering [Mon, 4 Jan 2016 19:38:21 +0000 (20:38 +0100)]
resolved: partially implement RFC5011 Trust Anchor support
With this patch resolved will properly handle revoked keys, but not
augment the locally configured trust anchor database with newly learned
keys.
Specifically, resolved now refuses validating RRsets with
revoked keys, and it will remove revoked keys from the configured trust
anchors (only until reboot).
This patch does not add logic for adding new keys to the set of trust
anchors. This is a deliberate decision as this only can work with
persistent disk storage, and would result in a different update logic
for stateful and stateless systems. Since we have to support stateless
systems anyway, and don't want to encourage two independent upgrade
paths we focus on upgrading the trust anchor database via the usual OS
upgrade logic.
Whenever a trust anchor entry is found revoked and removed from the
trust anchor a recognizable log message is written, encouraging the user
to update the trust anchor or update his operating system.
Lennart Poettering [Mon, 4 Jan 2016 19:27:45 +0000 (20:27 +0100)]
resolved: fix DNSSEC canonical ordering logic
When applying canonical DNSSEC ordering for an RRset only order by the
wire format of the RRs' RDATA, not by the full wire formatting. The RFC
isn't particularly clear about this, but this is apparently how it is
done. This fixes validation of pentagon.gov's DS RRset.
Lennart Poettering [Mon, 4 Jan 2016 19:25:55 +0000 (20:25 +0100)]
resolved: actually make use of message ID when logging about failed DNSSEC validation
Zbigniew Jędrzejewski-Szmek [Mon, 4 Jan 2016 19:10:13 +0000 (14:10 -0500)]
Merge pull request #2259 from evverx/fix-test-execute
core: only skip setup of "special" signals in test mode
Zbigniew Jędrzejewski-Szmek [Mon, 4 Jan 2016 18:49:00 +0000 (13:49 -0500)]
Merge pull request #2263 from awilfox/add-discoverable-root-for-itanium
Add GPT partition type GUID for Itanium root partition
Evgeny Vereshchagin [Mon, 4 Jan 2016 18:39:55 +0000 (18:39 +0000)]
core: don't enable special signals in test mode
Fixes:
$ systemd-analyze verify ...
Failed to open /dev/tty0: Permission denied
Andrew Wilcox [Mon, 4 Jan 2016 12:22:58 +0000 (06:22 -0600)]
Add GPT partition type GUID for Itanium root partition
Evgeny Vereshchagin [Mon, 4 Jan 2016 07:51:41 +0000 (07:51 +0000)]
tests: don't change hard limit in test-rlimit-util
Fixes:
$ make valgrind-tests TESTS=test-rlimit-util
...
Running test-rlimit-util
Assertion 'setrlimit(RLIMIT_NOFILE, &new) >= 0' failed at src/test/test-rlimit-util.c:41, function main(). Aborting.
See http://valgrind.org/docs/manual/dist.news.old.html
The setrlimit system call now simply updates the emulated limits as best
as possible - the hard limit is not allowed to move at all and just
returns EPERM if you try and change it.
Martin Pitt [Mon, 4 Jan 2016 07:36:41 +0000 (08:36 +0100)]
Merge pull request #2248 from APokorny/detect-touchscreens-with-btn-touch
udev: Fix touch screen detection
Evgeny Vereshchagin [Sun, 3 Jan 2016 15:28:52 +0000 (15:28 +0000)]
core: revert "manager: do not set up signals in test mode"
This reverts commit
5aa1054521596c3d268db5f4aff9f2b69647ffc9.
Fixes test-execute
$ sudo make check TESTS=test-execute
...
$ cat test-execute.log
+ test /tmp/test-exec_workingdirectory = /tmp/test-exec_workingdirectory
Test timeout when testing exec-workingdirectory.service
exec-workingdirectory.service
UMask: 0022
WorkingDirectory: /tmp/test-exec_workingdirectory
RootDirectory: /
NonBlocking: no
PrivateTmp: no
PrivateNetwork: no
PrivateDevices: no
ProtectHome: no
ProtectSystem: no
IgnoreSIGPIPE: yes
RuntimeDirectoryMode: 0755
StandardInput: null
StandardOutput: inherit
StandardError: inherit
FAIL test-execute (exit status: 1)
Lennart Poettering [Sun, 3 Jan 2016 16:57:44 +0000 (17:57 +0100)]
resolved: refuse revoked DNSKEYs in trust anchor
Lennart Poettering [Sun, 3 Jan 2016 16:56:50 +0000 (17:56 +0100)]
resolved: never authenticate RRsets with revoked keys
Lennart Poettering [Sun, 3 Jan 2016 16:54:01 +0000 (17:54 +0100)]
resolved: print a log message when we ignore an NSEC3 RR with an excessive amount of iterations
Lennart Poettering [Sun, 3 Jan 2016 13:19:37 +0000 (14:19 +0100)]
Merge pull request #2245 from ssahani/socket1
core: socket options fix SCTP_NODELAY
Lennart Poettering [Sun, 3 Jan 2016 13:19:00 +0000 (14:19 +0100)]
Merge pull request #2254 from kelemeng/master
Updated Hungarian translations
Lennart Poettering [Sun, 3 Jan 2016 13:18:05 +0000 (14:18 +0100)]
Merge pull request #2255 from teg/resolved-fixes-2
Fixes to NSEC3 proof v2
Tom Gundersen [Sun, 3 Jan 2016 13:02:10 +0000 (14:02 +0100)]
Merge pull request #2256 from poettering/dnssec10
Tenth DNSSEC patch set
Lennart Poettering [Sun, 3 Jan 2016 11:58:26 +0000 (12:58 +0100)]
resolve: add RFC4501 URI support to systemd-resolve-host
Lennart Poettering [Sat, 2 Jan 2016 21:12:13 +0000 (22:12 +0100)]
resolved: add negative trust anchro support, and add trust anchor configuration files
This adds negative trust anchor support and allows reading trust anchor
data from disk, from files
/etc/systemd/dnssec-trust-anchors.d/*.positive and
/etc/systemd/dnssec-trust-anchros.d/*.negative, as well as the matching
counterparts in /usr/lib and /run.
The positive trust anchor files are more or less compatible to normal
DNS zone files containing DNSKEY and DS RRs. The negative trust anchor
files contain only new-line separated hostnames for which to require no
signing.
By default no trust anchor files are installed, in which case the
compiled-in root domain DS RR is used, as before. As soon as at least
one positive root anchor for the root is defined via trust anchor files
this buil-in DS RR is not added though.
Tom Gundersen [Fri, 1 Jan 2016 22:39:07 +0000 (23:39 +0100)]
resolved: dnssec - properly take wildcards into account in NESC3 proof
For NXDOMAIN, it is not sufficient to prove that the next-closest
enclosure does not exist, we must also prove that there is no
wildcard domain directly below the closest enclosure which would
synthesise the name that has been requested.
For positive responses, in addition to exact matches, we should
accept wildcard ones. In that case we must first prove that
there is no precise match (i.e., that the closest encounter
is not the record itself) and secondly that the source of
synthesis exists.
Tom Gundersen [Sun, 3 Jan 2016 08:49:58 +0000 (09:49 +0100)]
resolved: dnssec - factor out hashed domain generation
Tom Gundersen [Fri, 1 Jan 2016 22:07:34 +0000 (23:07 +0100)]
resolved: don't conclude NODATA if CNAME exists
Instead introduce the new return-code DNSSEC_NSEC_CNAME to indicate
this condition. See RFC 6840, Section 4.3.
Gabor Kelemen [Sat, 2 Jan 2016 22:17:27 +0000 (23:17 +0100)]
Add initial Hungarian message catalog translation
Gabor Kelemen [Sat, 2 Jan 2016 22:16:52 +0000 (23:16 +0100)]
Update Hungarian translation
Lennart Poettering [Sat, 2 Jan 2016 21:11:38 +0000 (22:11 +0100)]
resolved: fix serialization of the root domain
Lennart Poettering [Sat, 2 Jan 2016 20:34:17 +0000 (21:34 +0100)]
resolved: only suffix RR key names with a dot if they don't have one yet
Lennart Poettering [Sat, 2 Jan 2016 20:33:17 +0000 (21:33 +0100)]
resolved: don't accept NSEC3 iteration fields unbounded
Lennart Poettering [Sat, 2 Jan 2016 20:32:45 +0000 (21:32 +0100)]
basic: modernize conf-files.c a bit
Lennart Poettering [Sat, 2 Jan 2016 14:18:23 +0000 (15:18 +0100)]
resolved: explain why we don't check IP addresses/ports of incoming DNS UDP traffic
Lennart Poettering [Sat, 2 Jan 2016 14:18:05 +0000 (15:18 +0100)]
resolved: extend RFCs list a bit
Tom Gundersen [Fri, 1 Jan 2016 15:48:35 +0000 (16:48 +0100)]
resolved: dnssec - add reference to the algorithm we implement
Tom Gundersen [Fri, 1 Jan 2016 21:18:24 +0000 (22:18 +0100)]
resolved: dnssec - prepend hashed labels to zone name
All hashed names consist of the hashed label prepended to the zone name, not to the
closest enclosure.
Tom Gundersen [Fri, 1 Jan 2016 21:10:55 +0000 (22:10 +0100)]
resolved: dnssec - rename some variables
Makes the NSEC3 proof somewhat simpler to follow.
Tom Gundersen [Mon, 28 Dec 2015 18:05:59 +0000 (19:05 +0100)]
resoled: dnssec - don't refuse to verify answer due to too many unrelated RRs
Let VERIFY_RRS_MAX be about the max number of RRs in an RRSet that we
actually try to verify, not about the total number of RRs in the RRSet.
Tom Gundersen [Mon, 28 Dec 2015 17:03:34 +0000 (18:03 +0100)]
resolved: dnssec - fix off-by-one in RSA key parsing
If the first byte of the key is zero, the key-length is stored in
the second and third byte (not first and second).
Andreas Pokorny [Fri, 1 Jan 2016 12:35:36 +0000 (13:35 +0100)]
udev: Fix touch screen detection
Use BTN_TOUCH or INPUT_PROP_DIRECT to detect touch screens.
Signed-off-by: Andreas Pokorny <andreas.pokorny@canonical.com>
Tom Gundersen [Fri, 1 Jan 2016 10:19:19 +0000 (11:19 +0100)]
Merge pull request #2241 from poettering/dnssec9
Ninth DNSSEC patch set
Susant Sahani [Thu, 31 Dec 2015 06:35:57 +0000 (12:05 +0530)]
core: socket options fix SCTP_NODELAY
SCTP_NODELAY is diffrent to TCP_NODELAY.
Apply proper options in case of SCTP.
Martin Pitt [Wed, 30 Dec 2015 10:27:52 +0000 (11:27 +0100)]
Merge pull request #2229 from cjmayo/m500
hwdb: move Logitech M-U0007 [M500] to 1000dpi
Evgeny Vereshchagin [Wed, 30 Dec 2015 03:33:43 +0000 (03:33 +0000)]
tests: add regression test for `systemctl restart systemd-journald`
See https://github.com/systemd/systemd/issues/2236
Lennart Poettering [Tue, 29 Dec 2015 20:27:11 +0000 (21:27 +0100)]
resolved: add a list of DNS-related RFCs and their implementation status in resolved
Lennart Poettering [Tue, 29 Dec 2015 19:52:27 +0000 (20:52 +0100)]
resolved: append RFC6975 algorithm data to EDNS OPT RR
Lennart Poettering [Tue, 29 Dec 2015 19:50:03 +0000 (20:50 +0100)]
resolved: NSEC3 hash algorithms are distinct from DS digest algorithms
Previously, we'd use the same set of identifiers for both, but that's
actually incorrect. It didn't matter much since the only NSEC3 hash
algorithm defined (SHA-1) is mapped to code 1 which is also what it is
encoded as in DS digests, but we really should make sure to use two
distinct enumerations.
Lennart Poettering [Tue, 29 Dec 2015 18:27:55 +0000 (19:27 +0100)]
update DNSSEC TODO
Lennart Poettering [Tue, 29 Dec 2015 18:27:09 +0000 (19:27 +0100)]
resolved: add comments referencing various RFCs to various places
Lennart Poettering [Tue, 29 Dec 2015 18:09:14 +0000 (19:09 +0100)]
resolved: include GOST in list of DNSSEC algorithms
We don't implement it, and we have no intention to, but at least mention
that it exists.
(This also adds a couple of other algorithms to the algorithm string
list, where these strings were missing previously.)
Lennart Poettering [Tue, 29 Dec 2015 18:08:22 +0000 (19:08 +0100)]
resolved: use CLAMP() intsead of MIN(MAX())