If we could not remove an address, then previously the corresponding
Address object was never removed, as it was freed only when we receive
remove notification from the kernel. So, we might confused that the
address still exists and being removed, and might block reconfiguring
the address.
With this change, even if we fail to remove an address, the
corresponding Address object will be freed.
This is similar to Request, but will be used on removing configuration
(e.g. address, route, and so on).
By using another queue for removing configuration, then we can avoid to
fill the reply callback buffer in sd-netlink by remove message calls.
Follow-up for 4e6a35e2b2.
To me this is the last major basic functionality that couldn't be
configured via credentials: the network.
We do not invent any new format for this, but simply copy relevant creds
1:1 into /run/systemd/network/ to open up the full functionality of
networkd to VM hosts.
Except for RTAX_CC_ALGO, all RTAX_XYZ attributes take uint32_t and
the kernel's default value is zero. So, let's unify handling of the
attributes.
This should not change any effective behavior. Just refactoring.
Then, split out route metric handling from networkd-route.c to
networkd-route-metric.c.
No functional change, just refactoring and preparation for later
commits.
Otherwise, e.g. when we enumerate a bridge port first, then the bridge
main interface, then the port cannot be managed by the main interface.
Fixes#30682.
The passed attribute type will be used later.
This also
- rename conf parsers,
- sort gperf entries by the attr type.
No functional change, just refactoring and preparation for later commits.
This also split config_parse_route_boolean() into two:
for GatewayOnline= and boolean route metrics.
No functional change, just refactoring and preparation for later commits.
This patch adds a new parameter to parse_ip_port_range, giving callers
the option to allow ranges to have their min be 0 instead of 1.
This is then used by parse_ip_ports_token, intern used by
parse_socket_bind_item to allow port 0 when restricting bind system
calls with SocketBindDeny / SocketBindAllow.
With this, users running server software written using the golang
standard library will be able to effectively sandbox their software,
albeit with a small loss in security protections by allowing the
process to bind on a random port in the
/proc/sys/net/ipv4/ip_local_port_range.
If we want to allow method replies to be extended without this breaking
compat, then we should set this flag. Do so at various method call
replies hence.
Also do it when parsing user/group records, which are expressly
documented to be extensible, as well as the hibernate JSON record.
Follow-up for b732606950 and
6706ce2fd2.
If Network.ignore_carrier_loss_set flag is set, then the timeout value
is always used, hence the logic implemented by
b732606950 never worked.
Some checks are slightly heavy, and there may be huge number of
interfaces. So, prcessing whole queue multiple times in a single event
may decrease the performance. Let's process the queued requests once per
event.
Otherwise, log_netdev_xyz() does not provide netdev name if it is called
in done(). It is hard to debug.
This should not change any effective behavior, at least with the current
implementation of done() per netdev kind.
Yu Watanabe
Lennart Poettering
Luca Boccassi
Mike Yuan
networkException