SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
89,227 Commits 2 Branches 1 Tag
01e6465b558570d2e33ebeb514b39cedde96014f
Commit Graph
5902 Commits
Author SHA1 Message Date
Yu Watanabe a2fbe9f3f9 network/sysctl-monitor: fix use-after-free 
Previously, manager_free() did not assign NULL to Manager.sysctl_shadow,
hence sysctl_clear_link_shadows() called by link_free() will causes
use-after-free. To fix the issue, this makes Manager.sysctl_shadow will be
set to NULL after it is freed,

Fixes a bug introduced by 6d9ef22acd.
 2024-09-16 15:12:47 +09:00
Yu Watanabe 7c778cecdb network/sysctl: several cleanups for sysctl_add_monitor() 
- rename rootcg -> root_cgroup_fd, to emphasize it is a fd,
- drop nested function call, and check error code.
 2024-09-16 14:36:54 +09:00
Yu Watanabe 46718d344f bpf-link: introduce bpf_ring_buffer_free() and friends 
Then, replace rb_free() in networkd.

Follow-up for 6d9ef22acd.
 2024-09-16 14:36:54 +09:00
Yu Watanabe 9295c7ae09 network/sysctl: use wrapped free functions 
No functional change, just refactoring.

Follow-up for 6d9ef22acd.
 2024-09-16 14:36:54 +09:00
Yu Watanabe 41afafbf2a network/sysctl-monitor: fix sanity check in cut_last() 
This also adds basic comment about the return code.

Follow-up for 6d9ef22acd.
 2024-09-16 14:36:54 +09:00
Lennart Poettering d7a6bb9891 tree-wide: make sigprocmask() changes more automatic 
This tries to get rid of most manual sigprocmask() changes, in favour
of:

1. The SD_EVENT_SIGNAL_PROCMASK flag to sd_event_add_signal()
2. The sd_event_set_signal_exit() call for handling SIGTERM/SIGINT
3. Move masking of SIGWINCH into ptyfwd, out of nspawn/vmspawn/run

And while we are at it get rid of a bunch of event source fields whose
lifetime is bound to the sd_event object they belong to anyway, and make
use of the "floating" event source feature of sd-event instead.
 2024-09-13 17:12:28 +02:00
Lennart Poettering a44fa55e26 networkd: move sysctl code to use PID_FMT 
Now that format-util.h doesn't pull in net/if.h anymore, we can use it
to format PIDs in the networkd-sysctl.c code.
 2024-09-13 07:28:51 +02:00
Lennart Poettering 868258cf38 basic: split ifname related calls from format-util.h into format-ifname.h 
This way we don't have to pull in net/if.h into format-util.h.

This is supposed to address https://github.com/systemd/systemd/pull/32212#discussion_r1755639881

No actual code changes, just a .c/.h file split-up.
 2024-09-13 07:27:47 +02:00
Matteo Croce 64e03ca8bf minor fixups for #32212 
Fix minor post merge comments
 2024-09-13 07:23:07 +02:00
Lennart Poettering 5892950ba4 Merge pull request #32212 from teknoraver/networkd-sysctl 
More visibility into systemd-networkd sysctls
 2024-09-12 17:28:59 +02:00
Mike Yuan 53c75243af network/wireguard: refuse default key if all zero 
Follow-up for fa724cd52c

We attempt to retrieve default key if eqzero(Wireguard.private_key),
but a all zero default key should be refused too.
 2024-09-12 09:25:50 +02:00
Matteo Croce 6d9ef22acd emit a warning in networkd if managed sysctls are changed 
Monitor the sysctl set by networkd for writes, if a sysctl is
overwritten with a different value than the one we set, emit a warning.
Writes are detected with an eBPF program attached as BPF_CGROUP_SYSCTL
which reports the sysctl writes only in net/.

The eBPF program only reports sysctl writes from a different cgroup than networkd.
To do this, it uses the `bpf_current_task_under_cgroup_proto()` helper,
which will be available allowed in BPF_CGROUP_SYSCTL from kernel 6.12[1].

Loading a BPF_CGROUP_SYSCTL program requires the CAP_SYS_ADMIN capability,
so drop it just after the program load, whether it loads successfully or not.

Writes are logged but permitted, in future the functionality can be
extended to also deny writes to managed sysctls.

[1] https://lore.kernel.org/bpf/20240819162805.78235-3-technoboy85@gmail.com/
 2024-09-11 23:07:00 +02:00
Matteo Croce 64629617b6 store the sysctls set by networkd 
networkd set several sysctl to set the network configuration. Save their
value so we can check is other processes change them.
 2024-09-11 23:01:25 +02:00
Matteo Croce 766bcf302a extend sysctl functions to shadow values 
Pass to all the sysctl_* functions a hashmap which can be used to
optionally save the value written in the sysctl.
 2024-09-11 23:01:25 +02:00
Yu Watanabe f49c8e6553 network/state-file: save assigned .netdev file even if the interface is unmanaged 
Follow-up for 2cf9b1a0ee.
 2024-09-10 19:30:17 +09:00
Yu Watanabe d0899c6a55 network/vxcan: also manage peer interface name by manager 
Then, the Link object for the peer interface can have a reference to the
corresponding NetDev object.
 2024-09-10 19:30:17 +09:00
Yu Watanabe 971c0ce85c network/vxcan: refuse when peer and the main interface names are equivalent 2024-09-10 19:30:17 +09:00
Yu Watanabe 2d5f58cf41 network/l2tp: manage l2tp session name by Manager 
Then, Link object for an L2TP session can have reference to the
corresponding NetDev object.
 2024-09-10 19:30:17 +09:00
Yu Watanabe 121d32b09c network/l2tp: refuse duplicated session name 2024-09-10 19:30:17 +09:00
Yu Watanabe c480e4cd66 network/l2tp: downgrade log level of several messages 
Also, use log_section_warning_errno() where applicable.
 2024-09-10 19:30:17 +09:00
Yu Watanabe 909acd37b8 network/veth: also manage peer name by Manager 
Then, the Link object for the peer interface can have a reference to the
corresponding NetDev object.
 2024-09-10 19:30:17 +09:00
Yu Watanabe 98fbb3b5b0 network/veth: refuse when peer and the main interface names are equivalent 2024-09-10 19:30:17 +09:00
Yu Watanabe c60cd572bd network/netdev: add attach(), detach(), set_ifindex(), and get_ifindex() to netdev vtable 
Currently no vtable sets these functions, but will be used later.
 2024-09-10 19:30:17 +09:00
Yu Watanabe 36ca0164ab network/netdev: allow to register the same NetDev object with multiple names 
Preparation for later commits.
 2024-09-10 19:30:17 +09:00
Yu Watanabe 5dc20e1acd network/netdev: split out netdev_set_ifindex_internal() and _impl() 
No functional change, just refactoring and preparation for later
commits.
 2024-09-10 19:30:13 +09:00
Yu Watanabe bfacb8fe1d network/netdev: split out netdev_attach() and netdev_attach_name() from netdev_load_one() 
No functional change, just refactoring and preparation for later
commits.
 2024-09-10 19:29:05 +09:00
Yu Watanabe 0dc71b9584 network/netdev: use hashmap_remove_value() on detaching NetDev from manager 
Then, it is not necessary to free NetDev.ifname when a conflicting
.netdev file is already loaded.

This also split out netdev_detach_name() and netdev_detach_impl().

No functional change, just refactoring.
 2024-09-10 19:29:05 +09:00
Yu Watanabe bc0d3f3842 network/netdev: downgrade log level in netdev_set_ifindex() 
This also makes netdev_enter_failed() called on caller side.

No functional change, just refactoring.
 2024-09-10 19:29:05 +09:00
Yu Watanabe 5d7de25052 network/netdev: check family of received NEWLINK message 
For safety. No functional change, just refactoring and preparation for
later commits.
 2024-09-10 19:28:56 +09:00
Yu Watanabe 72fd133dca network/route: use NetDev object assigned to Link 2024-09-10 16:38:07 +09:00
Yu Watanabe 1788c34628 network/netdev: also check ifindex, iftype, and kind when assigning NetDev to Link 
Even when a NetDev object with the same name found, its iftype or kind
may be different. For safety, let's also check them.
 2024-09-10 16:38:06 +09:00
Mike Yuan 0d3787deac networkctl: support editing netdev files by link and cat ":all" 
Also, don't abuse RET_GATHER in verb_cat(), where the failures
are most likely unrelated to each other.

Closes #34281
 2024-09-09 23:20:42 +02:00
Mike Yuan c9837c17d5 networkctl-status-link: show netdev files associated with link 2024-09-09 23:20:42 +02:00
Mike Yuan 2cf9b1a0ee network: store netdev drop-in paths and dump into state file 2024-09-09 23:20:41 +02:00
Mike Yuan 4c8dc66438 networkd-state-file: use ASSERT_PTR where appropriate 2024-09-09 21:45:42 +02:00
Yu Watanabe 47a71f9852 missing_network: drop unnecessary definition 
Now we have ipv6.h, hence the definition is not necessary anymore.
 2024-09-09 14:52:18 +09:00
Yu Watanabe 14a499ed77 network/route: fix typo 
Follow-up for 195bb6f97e.
 2024-09-07 22:22:44 +09:00
Yu Watanabe 195bb6f97e network/route: ignore EEXIST reply when the corresponding request is already detached 
Follow-ups for db8dc7c1dd.
Fixes #34275.
 2024-09-06 16:07:25 +09:00
Yu Watanabe dd1de202d7 network/address: use log_section_warning() 2024-09-06 10:38:57 +09:00
Yu Watanabe c6f2197fcf network/address: use generic section parser more 
This also
- rename variable n -> address,
- use log_syntax_parse_error() where applicable,
- add one more assertion for lvalue in config_parse_address().
 2024-09-06 10:38:15 +09:00
Yu Watanabe 6cf41d4603 network/address: introduce generic config parser for [Address] section 
Then, use generic conf parsers defined in conf-parser.[ch].
 2024-09-06 10:37:23 +09:00
Yu Watanabe c2e8e1f020 network: align table in network-gperf 2024-09-06 10:35:02 +09:00
Yu Watanabe e208fad798 network/address-label: use log_section_warning_errno() 2024-09-06 10:35:02 +09:00
Yu Watanabe 934cf1c06b network/address-label: introduce generic conf parser for [IPv6AddressLabel] section 
This also
- renames n -> label,
- use log_syntax_parse_error().

No functional change, just refactoring.
 2024-09-06 10:34:53 +09:00
Yu Watanabe 152b8a4e71 conf-parser: introduce config section parser wrapper 
It will be used later.
 2024-09-06 10:33:05 +09:00
A. Wilcox 79f0e94e27 edit-util: EditFileContext: avoid reserved 'stdin' 
The identifier 'stdin' is reserved in C.  It can be #defined to any
statement that evaluates to a FILE*.  We do not want that for our field,
so change to a more descriptive name.
 2024-09-06 08:29:45 +09:00
Daan De Meyer 2b9ced9072 network: Add support for mq qdisc 2024-09-04 14:56:40 +02:00
Daan De Meyer 3f14557ce0 network: Add support for multiq qdisc 2024-09-04 14:56:37 +02:00
Daan De Meyer 5064de1383 Merge pull request #34224 from yuwata/network-make-qdisc-reconfigurable 
network: make qdisc reconfigurable
 2024-09-04 12:07:16 +02:00
Yu Watanabe 304e2419c7 network/tclass: do not save tclass to Link before it is configured 
Otherwise, if the same kind of tclass is already assigned, parameters
configured in .network file will not be used. So, let's first copy the
tclass and put it on Request, then on success generate a new copy based
on the netlink notification and store it to Link.

This is the same as 0a0c2672db,
65f5f58156, and friends, but for tclass.
 2024-09-02 14:12:49 +09:00