From 90cfb61c71dd3b26f9c6e8113bd25c4a3fee400d Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 18 Jun 2024 11:43:58 +0200 Subject: [PATCH 1/3] sd-json.h: reword SD_JSON_WARNING/SD_JSON_DEBUG comments Even though we don't export json_log() in the public API, let's officially make the SD_JSON_WARNING/SD_JSON_DEBUG that control its effect in the public API. After all, for our own dispatcher functions they have a nice effect, and they are trivially reimplemented in user code independently. (We might eventually consider exporting json_log() as public API, but this is quite involved, given its use of macros/inline functions and iternal logging API). This mostly just swaps around the bit flags and cleans up comments. --- src/systemd/sd-json.h | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/src/systemd/sd-json.h b/src/systemd/sd-json.h index db37821f3a..5c6ca18951 100644 --- a/src/systemd/sd-json.h +++ b/src/systemd/sd-json.h @@ -269,23 +269,20 @@ typedef int (*sd_json_build_callback_t)(sd_json_variant **ret, const char *name, int sd_json_build(sd_json_variant **ret, ...); int sd_json_buildv(sd_json_variant **ret, va_list ap); -/* A bitmask of flags used by the dispatch logic. Note that this is a combined bit mask, that is generated from the bit - * mask originally passed into json_dispatch(), the individual bitmask associated with the static sd_json_dispatch callout - * entry, as well the bitmask specified for json_log() calls */ +/* A bitmask of flags used by the dispatch logic. Note that this is a combined bit mask, that is generated + * from the bit mask originally passed into sd_json_dispatch() and the individual bitmask associated with the + * static sd_json_dispatch_field callout entry */ typedef enum sd_json_dispatch_flags_t { - /* The following three may be set in sd_json_dispatch's .flags field or the json_dispatch() flags parameter */ SD_JSON_PERMISSIVE = 1 << 0, /* Shall parsing errors be considered fatal for this field or object? */ SD_JSON_MANDATORY = 1 << 1, /* Should existence of this property be mandatory? */ - SD_JSON_LOG = 1 << 2, /* Should the parser log about errors? */ - SD_JSON_STRICT = 1 << 3, /* Use slightly stricter validation than usually (means different things for different dispatchers, for example: don't accept "unsafe" strings in json_dispatch_string() + json_dispatch_string()) */ - SD_JSON_RELAX = 1 << 4, /* Use slightly more relaxed validation than usually (similar, for example: relaxed user name checking in json_dispatch_user_group_name()) */ - SD_JSON_ALLOW_EXTENSIONS = 1 << 5, /* Subset of JSON_PERMISSIVE: allow additional fields, but no other permissive handling */ - SD_JSON_NULLABLE = 1 << 6, /* Allow both specified type and null for this field */ - SD_JSON_REFUSE_NULL = 1 << 7, /* Never allow null, even if type is otherwise not specified */ - - /* The following two may be passed into log_json() in addition to those above */ - SD_JSON_DEBUG = 1 << 8, /* Indicates that this log message is a debug message */ - SD_JSON_WARNING = 1 << 9 /* Indicates that this log message is a warning message */ + SD_JSON_LOG = 1 << 2, /* Should the dispatcher log about errors? */ + SD_JSON_DEBUG = 1 << 3, /* When logging about errors use LOG_DEBUG log level at most */ + SD_JSON_WARNING = 1 << 4, /* When logging about errors use LOG_WARNING log level at most */ + SD_JSON_STRICT = 1 << 5, /* Use slightly stricter validation than usually (means different things for different dispatchers, for example: don't accept "unsafe" strings in json_dispatch_string() + json_dispatch_strv()) */ + SD_JSON_RELAX = 1 << 6, /* Use slightly more relaxed validation than usually (similar, for example: relaxed user name checking in json_dispatch_user_group_name()) */ + SD_JSON_ALLOW_EXTENSIONS = 1 << 7, /* Subset of JSON_PERMISSIVE: allow additional fields, but no other permissive handling */ + SD_JSON_NULLABLE = 1 << 8, /* Allow both specified type and null for this field */ + SD_JSON_REFUSE_NULL = 1 << 9 /* Never allow null, even if type is otherwise not specified */ } sd_json_dispatch_flags_t; typedef int (*sd_json_dispatch_callback_t)(const char *name, sd_json_variant *variant, sd_json_dispatch_flags_t flags, void *userdata); From 357fa81375b979d16741a525cc521ffdf1ed8d97 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 18 Jun 2024 11:47:06 +0200 Subject: [PATCH 2/3] sd-json: add comment clarifying that _SD_JSON_BUILD* enums are not to be used directly --- src/systemd/sd-json.h | 1 + 1 file changed, 1 insertion(+) diff --git a/src/systemd/sd-json.h b/src/systemd/sd-json.h index 5c6ca18951..316f51c20b 100644 --- a/src/systemd/sd-json.h +++ b/src/systemd/sd-json.h @@ -189,6 +189,7 @@ int sd_json_parse_file_at(FILE *f, int dir_fd, const char *path, sd_json_parse_f int sd_json_parse_file(FILE *f, const char *path, sd_json_parse_flags_t flags, sd_json_variant **ret, unsigned *reterr_line, unsigned *reterr_column); enum { + /* Do not use these directly, use the SD_JSON_BUILD_*() macros below */ _SD_JSON_BUILD_STRING, _SD_JSON_BUILD_INTEGER, _SD_JSON_BUILD_UNSIGNED, From 917b8bd3774749f39a4d2807574fa61698e4c67a Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 18 Jun 2024 11:46:41 +0200 Subject: [PATCH 3/3] update TODO --- TODO | 4 ---- 1 file changed, 4 deletions(-) diff --git a/TODO b/TODO index 0b3cfa989f..a19c8438ef 100644 --- a/TODO +++ b/TODO @@ -134,10 +134,6 @@ Features: open the inode via O_PATH first, then validate its type, and then convert to proper fd via fd_reopen() -* sd-json: before release figure out what to do about - SD_JSON_DEBUG+SD_JSON_WARNING. They are probably useless and should be hidden - in the public API since we don't expose log_json() - * rough proposed implementation design for remote attestation infra: add a tool that generates a quote of local PCRs and NvPCRs, along with synchronous log snapshot. use "audit session" logic for that, so that we get read-outs and