Commit Graph
2783 Commits
Author SHA1 Message Date
Yu Watanabe 4d13e4dcbb resolved: use usec_add() at one more place
Follow-up for 8458b7fb91.
Fixes CID#1612580.
2025-07-26 03:44:49 +09:00
Zbigniew Jędrzejewski-Szmek c5dcbd073e meson: use files() not find_program() for helper scripts
We went back and forth between 'prog.sh', files('prog.sh'), and
find_program('prog.sh'). We want to use files() or find_program() so that we
get a good error message if the file is missing. Behaviour of meson changed
over time, and in the past not all forms could be used in all places. For
example 0f4c4f3824 added find_program() in many
places to avoid repeated messages. But it seems that all recent meson versions
work fine with files().

find_program prints silly messages:
  Program tools/make-man-index.py found: YES
       (/home/zbyszek/src/systemd/tools/make-man-index.py)
  Program tools/meson-render-jinja2.py found: YES
       (/home/zbyszek/src/systemd/tools/meson-render-jinja2.py)
  ...
We know that those files will be found, they are part of the git checkout.
With files() this is gone and the meson output is easier to read.
2025-07-25 14:04:17 +02:00
Yu Watanabe 5c34d85c74 tree-wide: normalize usage of %m 2025-07-22 03:05:54 +09:00
Yu Watanabe 5918ba9c69 tree-wide: fix log messages: "Failed VERB" -> "Failed to VERB" 2025-07-22 03:05:33 +09:00
Zbigniew Jędrzejewski-Szmek 43419435c6 resolved: Implement continuous mDNS querying as per RFC6762 5.2 (#22532)
Allow for mDNS service/domain/types browsing.
A client can connect to the backend via varlink and receive updates as
the requested service becomes available.

The interval between the first two queries MUST be at least one second,
the intervals between successive queries MUST increase by at least a
factor of two.
When the interval between queries reaches or exceeds 60 minutes, a
querier MAY cap the interval to a maximum of 60 minutes, and perform
subsequent queries at a steady-state rate of one query per hour.

Cache maintenance performed by issuing queries at 80, 85, 90, 95% of the
TTL, and updating/removing the records depending on replies.

TODO:
Improve the DNS transaction logic when multiple clients subscribe to the
same service, ensuring that continuous queries are optimized.














































































































































































<!-- devel-freezer =
{"comment-id":"1625154850","freezing-tag":"v256-rc2"} -->
2025-07-18 12:54:33 +02:00
Zbigniew Jędrzejewski-Szmek cf71be0a9e resolvectl: use pager for help output 2025-07-15 20:31:58 +01:00
Vishal Chillara SrinivasandVishwanath Chandapur 8458b7fb91 resolve: Implement continuous mDNS querying as per RFC6762 5.2
Allow for mDNS service/domain/types browsing.

A client can connect to the backend via varlink and receive updates as the
requested service becomes available.
The interval between the first two queries MUST be at least one second,
the intervals between successive queries MUST increase by at least a factor of two.
When the interval between queries reaches or exceeds 60 minutes, a querier MAY cap
the interval to a maximum of 60 minutes, and perform subsequent queries at a
steady-state rate of one query per hour.
Delete expired cache entries one second after goodbye packet received
as per RFC6762 Section 10.1

Cache maintenance:
The querier should plan to issue a query at 80% of the record lifetime, and
then if no answer is received, at 85%, 90%, and 95%.
If an answer is received, then the remaining TTL is reset to the value given
in the answer, and this process repeats for as long as the Multicast DNS querier
has an ongoing interest in the record.
If no answer is received after four queries, the record is deleted when it
reaches 100% of its lifetime.

TODO:
Improve the DNS transaction logic when multiple clients subscribe to
the same service, ensuring that continuous queries are optimized.

Co-authored-by: Vishwanath Chandapur <vishwanath.chandapur@philips.com>
2025-07-15 22:55:31 +05:30
Vishal Chillara SrinivasandVishwanath Chandapur 6ccc2b24f5 resolve: Refactor mDNS transaction max attempts
Prepare for upcoming mDNS browse services.

Prevent continuous queries from being attempted thrice.

Co-authored-by: Vishwanath Chandapur <vishwanath.chandapur@philips.com>
2025-07-14 14:50:03 +05:30
Vishal Chillara SrinivasandVishwanath Chandapur f7d5177dd2 reslove: Refactor DNS Answer to support 'until' in DnsAnswerItem
Prepare for mDNS browse services to facilitate scheduled cache
maintenance queries when browsing for services.

Introduce dns_answer_add_full() and dns_answer_add_extend_full()
to explicitly handle the 'until' argument, enabling fine-grained control
over the time property of DNS answers.

Ensure backward compatibility while providing the flexibility to
specify 'until' for specific cases when needed

Co-authored-by: Vishwanath Chandapur <vishwanath.chandapur@philips.com>
2025-07-14 14:50:03 +05:30
Vishal Chillara SrinivasandVishwanath Chandapur 108bd5c297 resolve: Rename 'DnssdService', update all dependent code components
Prepare for upcoming mDNS browse services.
Distinguish between registered and discovered services to avoid confusion.

Co-authored-by: Vishwanath Chandapur <vishwanath.chandapur@philips.com>
2025-07-14 14:50:03 +05:30
DaanDeMeyer 47f761fda6 basic: Use hyphens in missing header names instead of underscores 2025-07-13 12:41:14 +02:00
Yu Watanabe 0b565facc4 Revert "resolve: query the parent zone for DS records"
This reverts commit 49ff90c70d.
2025-07-10 15:18:07 +02:00
Daan De Meyer 76e3cc469d Move missing_xyz.h for glibc headers to src/basic/include/ (#37960) 2025-07-03 13:47:46 +02:00
Zbigniew Jędrzejewski-Szmek 867cba15bc resolve: add converters for sshfp key types and algs
With the data center move in the Fedora project, the ssh keys have changed.
The list with numerical values is hard to read…

$ resolvectl -t sshfp query pkgs.fedoraproject.org
Old:
pkgs.fedoraproject.org IN SSHFP 1 1 18270c9131ef9664861f5aa675a981146573cce0 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP 1 2 b067e6eb4c3e2d0e8bb37d6799493b762131816fe979940bbe660470abe6efbb -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP 3 1 a1ad871a5eabe3027728d498a89895fb5bf5b290 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP 3 2 c3dc523f99bb5155ec87f40fd1aa198c68f349d75beeccf60e87b44c9b461907 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP 4 1 e1265f46012ee40967127e06cf5533b270568428 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP 4 2 acaa1ee6292d01f1ae7881fdf03aaf7d7b0814e34e94c3558a25e4d1aaab8f94 -- link: wlp0s20f3
New:
pkgs.fedoraproject.org IN SSHFP RSA     SHA-1   18270c9131ef9664861f5aa675a981146573cce0 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP RSA     SHA-256 b067e6eb4c3e2d0e8bb37d6799493b762131816fe979940bbe660470abe6efbb -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP ECDSA   SHA-1   a1ad871a5eabe3027728d498a89895fb5bf5b290 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP ECDSA   SHA-256 c3dc523f99bb5155ec87f40fd1aa198c68f349d75beeccf60e87b44c9b461907 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP Ed25519 SHA-1   e1265f46012ee40967127e06cf5533b270568428 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP Ed25519 SHA-256 acaa1ee6292d01f1ae7881fdf03aaf7d7b0814e34e94c3558a25e4d1aaab8f94 -- link: wlp0s20f3
2025-07-03 13:46:40 +02:00
Yu Watanabe 33527a9b0c test-dns-search-domain: several cleanups
- use STRV_MAKE() macro,
- add several missing assertions,
- use more suitable ASSERT_XYZ() macros,
- drop TEST(dns_search_domain_unlink_all), as it is already tested in
  TEST(dns_search_domain_new_system_limit).
2025-07-03 08:46:26 +09:00
Yu Watanabe 549f679a49 basic: move missing_socket.h -> include/sys/socket.h 2025-07-01 12:27:59 +09:00
Zbigniew Jędrzejewski-Szmek 7d247d3cb8 meson: drop explicit custom_target names
[1] says:
> Since 0.60.0 the name argument is optional and defaults to the basename of
> the first output
We specify >= 0.62 as the supported version, so drop the duplicate name in all cases
where it is the same as outputs[0], i.e. almost all cases.

[1] https://mesonbuild.com/Reference-manual_functions.html#custom_target
2025-06-28 17:14:50 +02:00
Lennart Poettering 4b6dbd4ea5 resolved: don't wait for TLS close_notify replies unnecessarily
This is based on #35764 by Guruswamy Basavaiah, but covers further code
paths.

This ensures that when we initiate a TLS shutdown we'll write out our
own close_notify message, but not wait for the close_notify reply from
the server side anymore.

Replaces: #35764
2025-06-27 14:32:28 +01:00
Lennart Poettering 635b42edd9 resolved: when determining error to return, prefer "conclusive" over "inconclusive" errors
When asked to look something up, and all scopes we contact fail we need
to pick a suitable error code for the failure, and given that we look up
things on multiple scopes we might have multiple errors to choose from.
So far we simply picked the error from the last scope in the list, which
hence would be pretty arbitrary.

Let's tweak this a bit, and if we have multiple errors to choose from,
let's prefer "conclusive" failures over "inconclusive" ones. The
"inconclusive" ones in this sense are the ones where we didn't even issue
a request, but couldn't even do that because we had no server, no
network or things like that. The "conclusive" ones are the errors we got
from a server, that hence a "real" in a way.

This addresses the confusion described in #37969. For LLMNR lookups we
generally refuse looking up A addresses via IPv6 and AAAA via IPv4. This
generates a DNS_TRANSACTION_NO_SERVERS error, which we would then return
for one type of lookup but not for the other, because the IPv6 scope is
generally created after the IPv4 one, and hence so far won.

Fixes: #37969
2025-06-27 14:30:40 +01:00
Yu Watanabe 9a9139e087 test: use safe_glob() at one more place
This also makes the test use ASSERT_OK() and STRV_FOREACH() macros.

No functional change, just refactoring.
2025-06-23 23:11:44 +09:00
Lennart Poettering 884fb39f33 resolved: make bypass tests work
It's not sufficient to append a DNS key to a packet, we must also update
the qdcount too. We got this right in most tests but didn#t here.
Moreover, we must extract the packet then to actually have a DnsQuestion
properly filled in.

Fix that. Without this the tests didn't test anything reasonable.
2025-06-19 18:30:06 +02:00
Lennart Poettering 576a2bc79b resolved: honour RefuseRecordTypes= also in proxy mode
Fixes: #36491
2025-06-19 18:02:54 +02:00
Lennart Poettering 95625f3cb6 resolved: use dns_question_isempty() where appropriate 2025-06-19 18:02:53 +02:00
Lennart Poettering 2aacaf81e1 resolved: split out helper that determines on RefuseRecordTypes= match 2025-06-19 18:02:24 +02:00
Lennart Poettering 9ea5a6e7d6 fs-util: replace symlink_atomic_full_label() by a flag to symlinkat_atomic_full()
More porting work to label_ops_pre()/label_ops_post()

This also enables labelling of the /etc/localtime symlink in
systemd-firstboot, which should address one small facet of #37857
2025-06-18 10:21:25 +02:00
George Tsiamasiotis c60d2a626b resolved: Tweak link-local addresses relevancy
We now consider link-local addresses routable when we have configured
unicast link-local dns servers. This allows creating the DNS scope, even
when the interface doesn't get a routable address.
2025-06-18 04:57:27 +09:00
Yu Watanabe 752cdf5051 manager: also restart stub listner on reload
Previously, the extra stub listners were stopped but new ones were not
started. Also, the main stub listners were not restarted, hence the
new settings were not applied. This fixes the above two issues.

Note, to fix the issue, we need to keep CAP_NET_BIND_SERVICE capability
to make it allow to bind stub listner later.

Fixes #37843.
2025-06-16 22:02:30 +09:00
Yu Watanabe 9ed99b0793 resolve: several cleanups for manager_dispatch_reload_signal()
- set defaults after all existing configs and setups cleared,
- mention failures are ignored in log messages,
- drop one redundant log message,
- do not return negative errno but exit event loop on critical failure.
2025-06-16 22:02:30 +09:00
Yu Watanabe 872603b583 resolve: several cleanups for manager_new()
- mention the error is ignored in the log message,
- drop redundant log message, as dnssd_load() logs on failure,
- voidify manager_load_delegates().
2025-06-16 22:02:30 +09:00
Yu Watanabe 450a4edfc3 resolve: coding style fix 2025-06-16 22:02:30 +09:00
Yu Watanabe 5d5edcd3f4 resolve: fix indentation 2025-06-16 22:02:30 +09:00
Lennart Poettering 373e6cdadb resolved: ignore mDNS replies from legacy mDNS ports
mDNS replies always have to come from the mDNS port (unlike mDNS
queries, which are also allowed from non-mDNS ports). Hence refuse this.

Fixes: #33806
2025-06-11 00:33:05 +01:00
Yu Watanabe 5814acca9a resolve: exit from loop for transactions when transactions has been regenerated
Fixes #37458.
2025-06-10 17:30:03 +01:00
Yu Watanabe 3b1850d906 Bugprone argument comment 10 (#37755)
Follow up from https://github.com/systemd/systemd/pull/37712
2025-06-06 06:07:05 +09:00
Lennart Poettering 231a0417cd resolvectl: improve error message if we do not support dumping payload of RR 2025-06-05 12:43:36 +02:00
Lennart Poettering 141894f53a resolvectl: output slightly more data when --raw=payload is used
Let's also show A/AAAA data in binary form if --raw=payload is used. For
these RR types there's only a single data field, hence it's obbviously
meant.

Inspired by: #37737
2025-06-05 12:38:28 +02:00
Jelle van der Waa 63b21f503d resolved-manager: rename 's' -> 'source' 2025-06-04 15:49:26 +02:00
Yu Watanabe 6e47959685 Bugprone argument comment 9 (#37712)
Follow up from https://github.com/systemd/systemd/pull/37678
2025-06-04 22:33:51 +09:00
Lennart Poettering 959d7f1759 resolved: honour SD_RESOLVED_NO_CNAME flag when processing cache
Fixes: #33300
Replaces: #35102
2025-06-04 12:52:11 +01:00
Jelle van der Waa ac3a403486 treewide: correct argument comments for sd_event_add_time 2025-06-04 13:32:24 +02:00
Zbigniew Jędrzejewski-Szmek 42ba99748d various: do not include file names directly in error messages
git grep -l 'Failed to open /'|xargs sed -r -i 's|"Failed to open (/[^ ]+): %m"|"Failed to open %s: %m", "\1"|g'
git grep -l $'Failed to open \'/'|xargs sed -r -i $'s|"Failed to open \'(/[^ ]+)\': %m"|"Failed to open %s: %m", "\\1"|g'
git grep -l "Failed to open /"|xargs sed -r -i $'s|"Failed to open (/[^ ]+), ignoring: %m"|"Failed to open %s, ignoring: %m", "\\1"|g'
+ some manual fixups.
2025-06-02 11:10:38 +02:00
Daan De Meyer 5ea01af240 meson: Use .inc for generated code meant to be included in other files
These files use the .h extension but are not standalone so let's not
make it appear like they are proper headers and instead use the .inc
extension.
2025-05-22 11:25:29 +02:00
Daan De Meyer 284d76414e resolve: Clean up includes
Split out of #37344.
2025-05-21 23:50:31 +09:00
Daan De Meyer 9f74f56f36 test-tables: Pass enum type to test_table() as well
clang-include-cleaner has a hard time figuring out unused includes
with all the macro string concatentation we're doing in test_table().
Let's help it out a little by also passing the enum type into test_table().

While technically not needed, this makes the tests a bit more self-descriptive
and not really much more verbose so it feels like a good chance regardless,
even if the primary purpose is to help clang-include-cleaner figure out
used and unused includes.
2025-05-21 13:24:42 +02:00
Yu Watanabe ef27ebab08 Clean up more includes (#37527)
Split out of #37344
2025-05-21 19:43:39 +09:00
Jelle van der Waa 00299a80f7 sd-event: rename 's' -> 'ret' 2025-05-21 10:50:25 +02:00
Daan De Meyer 8b5ce49591 basic: Include time-util.h in constants.h
constants.h defines a bunch of constants that use macros from
time-util.h, so add the needed include. To avoid cyclic dependencies,
we move the HAS_FEATURE_MEMORY_SANITIZER and HAS_FEATURE_ADDRESS_SANITIZER
logic to macro.h and get rid of the constants.h include there.

The rest of this commit is adding missing constants.h includes where
needed due to it being removed from macro.h.
2025-05-21 10:49:42 +02:00
Lennart Poettering 45817e9245 resolvectl: show delegate information, too 2025-05-20 23:00:53 +02:00
Lennart Poettering 5c45b341d3 resolvectl: rework parsing of dns server + search domain bus properties
Let's handle the per-link and the global dns server/search domain
property parsing the same. Let's use a flags field for three separate
booleans, and unify more code.
2025-05-20 23:00:53 +02:00
Lennart Poettering 7928c0e0a1 resolved: add concept of delegating lookups below certain domains to specific DNS servers
This permits configuration of additional "delegates" which ensure that
lookups for certain DNS zones are routed to specific sets of DNS
servers, in addition to the routes we create for each network interface.

For now, this allows only static configuration, but eventually we should
open this up to IPC.

Fixes: #5573 #14159 #20485 #21260 #24532 #32022

(Fixes #32022, because now redundant)
2025-05-20 23:00:03 +02:00