Daniel Wang [Wed, 24 May 2017 12:05:49 +0000 (05:05 -0700)]
DHCP: Fail link_dhcp_set_routes promotely if no address is assigned from lease (#6009)
Currently the local variable `address` is unintialized if the DHCP lease
doesn't provide a router address (when r == -ENODATA). Thus the
subsequent call to route_scope_from_address will result in accessing an
unintialized variable.
As a matter of fact, sd-dhcp-client ignores DHCP leases without an
address so link_dhcp_set_routes probably will never be called without a
valid address.
NeilBrown [Tue, 23 May 2017 07:42:26 +0000 (17:42 +1000)]
Allow TimeoutSec=0 to work as documented in mount units and elsewhere (#6013)
Since commit 36c16a7cdd6c ("core: rework unit timeout handling, and add
new setting RuntimeMaxSec=") TimeoutSec=0 in mount units has
cause the mount to timeout immediately instead of never as documented.
There is a similar problem with Socket.TimeoutSec and Swap.TimeoutSec.
These are easily fixed using config_parse_sec_fix_0().
Automount.TimeoutIdleSec looks like it could have the same problem,
but doesn't because the kernel treats '0' as 'no timeout'.
It handle USEC_INFINITY correctly only because that constant has
the value '-1', and when round up, it becomes zero.
To avoid possible confusion, use config_parse_sec_fix_0() as well, and
explicitly handle USEC_INFINITY.
tomty89 [Tue, 23 May 2017 07:41:36 +0000 (15:41 +0800)]
nspawn: add nosuid and nodev to /tmp mount (#6004)
When automatic /tmp mount was introduced to nspawn in v219, it was done without having the nosuid and nodev mount options, which was the same case as systemd's default tmp.mount unit back then.
nosuid and nodev was added to tmp.mount(.m4) in v231 for security reasons. matching the nspawn /tmp mount entry against that.
sjoerd-ccu [Tue, 23 May 2017 07:10:59 +0000 (09:10 +0200)]
networkd-link: Receive LLDP on Bridge slaves not master (#5995)
LLDP should be received on bridge slaves as they're the entities
directly connected to a peer. Receiving LLDP on the bridge device makes
little sense, Linux by default even filters out LLDP going onto the
bridge device.
Flip the current logic, receive LLDP on bridge slaves don't listen for
them on the bridge itself.
Let's downgrade the warning introduced by 955d99edc7991386a36e3d33924cc584931fde91 to debug, as we really
shouldn't log at more than debug level from library code.
(And while we are at it, print the MTU as the right (unsigned) type in
the format string.)
core/load-droping: avoid oom warning when the unit symlink is not a template
unit_name_template returns -EINVAL if the unit name is not a template, but
the code assumed that OOM is the only failure mode. Fix that to emit the warning
if a non-template unit is encountered (because in this case we expect the name
to match exactly), and just skip the warning on other errors (presumably oom).
Daniel Wang [Sat, 20 May 2017 11:05:18 +0000 (04:05 -0700)]
DHCP: when adding static routes set scopes properly (#5982)
DHCP responses could include static routes, but unfortunately not an
option to tell what scope to use. So it's important that the client sets
it properly.
This mimics what the `ip route add` command does when adding a static
route without an explicit scope:
* If the destination IP is on the local host, use scope `host`
* Otherwise if the gateway IP is null (direct route), use scope `link`
* If anything else, use the current default `global`.
basic/time-util: make parsing of dual_timestamp more strict
*scanf functions set errno on i/o error. For sscanf, this doesn't really apply,
so (based on the man page), it seems that errno is unlikely to be ever set to a
useful value. So just ignore errno. The error message includes the string that
was parsed, so it should be always pretty clear why parsing failed.
On the other hand, detect trailing characters and minus prefix that weren't
converted properly. This matches what our safe_ato* functions do. Add tests to
elucidate various edge cases.
tree-wide: when %m is used in log_*, always specify errno explicitly
All those uses were correct, but I think it's better to be explicit.
Using implicit errno is too error prone, and with this change we can require
(in the sense of a style guideline) that the code is always specified.
journald: process "binary" fields the same as text fields
MESSAGE=data\n and MESSAGE\n40000000data\n are both valid serializations, so
they should be stored in the journal. Before, MESSAGE, SYSLOG_FACILITY,
SYSLOG_IDENTIFIER, PRIORITY, and OBJECT_PID would be only honoured if they were
given in the first form.
journald: properly process multiple entries in the same native packet
For all except the last entry in a single packet, we would dispatch the
message to the journal, but not forward it, nor perform proper cleanup.
Rewrite the code to process each entry in a helper function, and make
server_process_native_message() just call this function in a loop.
Fixes #5643.
v2:
- properly decrement *remaining when processing entry separator
Hans de Goede [Fri, 19 May 2017 14:05:27 +0000 (16:05 +0200)]
hwdb: Fix mapping for home-key on Cube iWork8 air (#5994)
The intent of the hwdb entry for the Cube iWork8 air tablet buttons is
to fix them being swapped. The kernel is using left-meta for the
home key (it is being treated as the windows key on keyboards, as it has
a windows logo on most x86 tablets).
Fix the hwdb entry to only swap the buttons and not change the keycode
emitted by the home key.
timex::time::tv_sec can have different sizes depending on the
host architecture. On x32 in particular, it is 8 bytes
long while the long int type is only 4 bytes long. Hence,
using li as a format specifier will trigger a format
error. Thus, better use PRI_TIME instead of li which is
actually the right format specifier to use for time_t.
timex::time::tv_usec and timex::freq can have different sizes
depending on the host architecture. On x32 in particular,
it is 8 bytes long while the long int type is only 4 bytes
long. Hence, using li as a format specifier will trigger
a format error. Thus, introduce a new format specifier
PRI_TIMEX which is defined as PRIi64 on x32 and li
everywhere else.
timespec::tv_nsec can have different sizes depending on the
host architecture. On x32 in particular, it is 8 bytes long
while the long int type is only 4 bytes long. Hence, using
ld as a format specifier will trigger a format error. Thus,
explicitly cast timespec::tv_nsec to nsec_t and use PRI_NSEC
as the format specifier to make sure the sizes for both match.
timespec::tv_nsec can have different sizes depending on the
host architecture. On x32 in particular, it is 8 bytes long
while the long int type is only 4 bytes long. Hence, using
ld as a format specifier will trigger a format error. Thus,
explicitly cast timespec::tv_nsec to nsec_t and use PRI_NSEC
as the format specifier to make sure the sizes for both match.
Peter Hutterer [Fri, 19 May 2017 08:56:29 +0000 (18:56 +1000)]
udev: skip EVDEV_ABS override on devices without EV_ABS (#5984)
When we first handle a device with an EVDEV_ABS override, check if it has
EV_ABS bits. If not, print a warning and continue. This is required on devices
where the match string applies to multiple device nodes, not all of which may
have absolute axes.
udev: turn off -Wformat-nonliteral for one safe case
c20e6de897b2378bc3f936e1e265d2d2e2450a73 introduced a format string as
variable, but didn't turn off -Wformat-nonliteral warnings on it, thus
breaking the build. Let's fix that, by simply turning off the warning in
this case, as we know it's safe.
test-login.c is largely rewritten to use _cleanup_ and give more meaningful
messages (function names are used instead of creative terms like "active
session", so that when something unexpected is returned, it's much easier to
see what function is responsible).
The monitoring part is only activated if '-m' is passed on the command line.
It runs against the information from /run/systemd/ in the live system, but that
should be OK: logind/sd-login interface is supposed to be stable and both
backwards and forwards compatible.
If not running in a login session, some tests are skipped.
Those two changes together mean that it's possible to run test-login in the
test suite.
Tests for sd_pid_get_{unit,user_unit,slice} are added.
sd-login: always return two arrays of same length from sd_seat_get_sessions
sd_seat_get_sessions returns two arrays, that in principle should always match:
the session names and corresponding uids. The second array could be shorter only
if parsing or uid conversion fails. But in that case there is no way to tell
*which* uid is wrong, so they are *all* useless. It's better to simplify things and
just return an error if parsing fails.
sd-login: read list of uids of sessions from UIDS not ACTIVE_SESSIONS
As described by Luke Shumaker:
sd_seat_get_sessions looks at /run/systemd/seats/${seat_name}:SESSIONS to get
the list of sessions (which I believe is correct), and at
/run/systemd/seats/${seat_name}:ACTIVE_SESSIONS for the list of users (which
I believe is incorrect); I believe that it should look at the UIDS field for
the list of users. As far as I can tell, the ACTIVE_SESSIONS field is never
even present in the seats file. I also believe that this has been broken
since the function was first committed almost 6 years ago.
Patrik Flykt [Fri, 12 May 2017 13:48:39 +0000 (16:48 +0300)]
test-ndisc-ra: Add Router Advertisement test cases
Add tests for prefix creation, router variable setting and finally
verify that a Router Advertisement is properly formatted when sending.
Also check that there is a Router Advertisment with zero lifetime
when Router Advertisement sending is stopped.
Patrik Flykt [Fri, 12 May 2017 13:48:38 +0000 (16:48 +0300)]
sd-radv: Receive Router Solicitations
Receive Router Solicitations and send a unicast Router Advertisment
in response. Refactor ICMPv6 packet handling code so that the common
ICMPv6 validation parts are reused between the existing router
discovery and the new functionality adding reception of Router
Solicitation messages.
Patrik Flykt [Fri, 12 May 2017 13:48:37 +0000 (16:48 +0300)]
sd-radv: Send Router Advertisments
Create and remove the ICMPv6 Router Advertisement socket file
descriptor and implement Router Advertisment sending. As not
all options are mandatory, use IO vectors to point to the included
options and the prefix information.
Patrik Flykt [Fri, 12 May 2017 13:48:35 +0000 (16:48 +0300)]
icmp6-util: Bind Router Advertisement socket
Reuse and refactor the functionality already present for Router
Solicitations in order to create a socket for sending Router
Advertisements. Anticipate reception of incoming Router
Solicitations by setting the ICMPv6 filter accordingly. Also set
the unicast hop limit to 255 for ICMPv6 sockets as unicast Router
Advertisments are to be sent in response to Router Solicitations.
Update the Router Solicitation test case code with a function
definition in order to keep the test case working.
Router Advertisements are sent uniformly distributed between a
minimum and maximum time according to RFC 4861, Section 6.2.4.
Default values from RFC 4861 are for now used as minimum and
maximum Router Advertisement timeouts.
When stopping, a Router Advertisement with a router lifetime set
to zero is sent in order to inform any nodes that the interface
on this host no longer is a router.
Patrik Flykt [Fri, 12 May 2017 13:48:30 +0000 (16:48 +0300)]
networkd: Add Router Advertisement variables
Add variables for enabling Router Advertisements, router lifetime as
well as managed and other information flags indicating use of DHCPv6.
Add configuration of default router preferences as defined in RFC 4191.
IPv6PrefixDelegation in the [Network] section has to be set in order
to enable prefix delegation. The rest of the prefix delegation values
are stored in the [IPv6PrefixDelegation] section. The host will act as
a default router if it is given a non-zero lifetime with
RouterLifetimeSec. Managed and OtherInformation booleans set the level
of DHCPv6 support, and the RouterPreference configures the router's
preference between low, medium and high. Words 'normal' and 'default'
are added as synonyms for 'medium' just to make configuration simpler.
This adds a section like the following to .network configuration files:
[Network]
IPv6PrefixDelegation=true
Patrik Flykt [Fri, 12 May 2017 13:48:29 +0000 (16:48 +0300)]
networkd: Add IPv6Prefix sections to the network configuration files
Support zero or more [IPv6Prefix] sections in the network configuration
files. Each section can have one Prefix=<subnet>[/<prefixlength>]
option, with the preferred and valid lifetimes specified by
ValidLifetimeSec and PreferredLifetimeSec measured in seconds, and
with onlink and address autoconfiguration booleans specified by
OnLink and AddressAutoconfiguration variables.
This adds a section like the following to .network configuration files:
[IPv6Prefix]
Prefix=2001:db8:dead:beef::/64
OnLink=true
AddressAutoconfiguration=true
ValidLifetimeSec=1500
PreferredLifetimeSec=1000
Patrik Flykt [Fri, 12 May 2017 13:48:27 +0000 (16:48 +0300)]
sd-radv: Add Router Advertisement prefix handling
Define Router Advertisement prefix structure. Add the Prefix
Information ICMPv6 option defined in RFC 4861 to the prefix
information structure, as it will simplify sending a Prefix
Information option later on. In order to handle endianness
correctly, the structure is redefined here instead of using
the one in netinet/icmp6.h.
Add functions to create and modify prefix information and set
default values as defined in RFC 4861, Section 6.2.1.
Ronny Chevalier [Sun, 14 May 2017 11:19:11 +0000 (13:19 +0200)]
conf-parser: fix wrong argument given to log_syntax_invalid_utf8
The condition is on "word", hence we give word instead of rvalue.
An assert would be triggered if !utf8_is_valid(word) is true and
rvalue == NULL, since log_syntax_invalid_utf8 calls utf8_escape_invalid
which calls assert(str).
A test case has been added to test with valid and invalid utf8.
tests,meson: add test-bus-vtable, compiled as C and C++
This test is mostly a compilation test that checks that various defines in
sd-bus-vtable.h are valid C++. The code is executed, but the results are not
checked (apart from sd-bus functions not returning an error). test-bus-objects
contains pretty extensive tests for this functionality.
The C++ version is only added to meson, since it's simpler there.
Because of the .cc extension, meson will compile the executable with c++.
This test is necessary to properly check the macros in sd-bus-vtable.h. Just
running the headers through g++ is not enough, because the macros are not
exercised.
This adds a meson test because it fits nicely into the existing framework.
It should be enough to run this test once in a while, so I don't think it's
crucial to also have it under autotools.
This adds a modified version of dhcp6_option_parse_domainname() that is
able to parse compressed domain names, borrowing the idea from
dns_packet_read_name(). It also adds pieces in networkd-link and
networkd-manager to properly save/load the added option field.
Gary Tierney [Tue, 2 May 2017 20:05:32 +0000 (21:05 +0100)]
audit-fd: check for CAP_AUDIT_WRITE before opening an audit socket
Adds a check to audit-fd.c to ensure that CAP_AUDIT_WRITE is present in
the set of effective capabilities before opening an audit netlink
socket. This ensures that unprivileged systemd instances (MANAGER_USER)
don't try to log AVC permission checks with the audit subsystem when
CAP_AUDIT_WRITE is not present.
The previously mentioned commit inadvertently broke a lot of SELinux related
functionality for both unprivileged users and systemd instances running as
MANAGER_USER. In particular, setting the correct SELinux context after a User=
directive is used would fail to work since we attempt to set the security
context after changing UID. Additionally, it causes activated socket units to
be mislabeled for systemd --user processes since setsockcreatecon() would never
be called.
Reverting this fixes the issues with labeling outlined above, and reinstates
SELinux access checks on unprivileged user services.
nss-resolve: drop the internal fallback to libnss_dns (#5945)
If we could not communicate with systemd-resolved, we would call into
libnss_dns. libnss_dns would return NOTFOUND for stuff like "localhost" and
other names resolved by nss-myhostname, which we would fall under the !UNAVAIL=
condition and cause resolution to fail. So the following recommended
configuration in nsswitch.conf would not work:
hosts: resolve [!UNAVAIL=return] dns myhostname
Remove the internal fallback code completely so that the fallback logic
can be configured in nsswitch.conf.
Tested with
hosts: resolve [!UNAVAIL=return] myhostname
and
hosts: resolve [!UNAVAIL=return] dns myhostname