Commit Graph
2772 Commits
Author SHA1 Message Date
Yu Watanabe 0b565facc4 Revert "resolve: query the parent zone for DS records"
This reverts commit 49ff90c70d.
2025-07-10 15:18:07 +02:00
Daan De Meyer 76e3cc469d Move missing_xyz.h for glibc headers to src/basic/include/ (#37960) 2025-07-03 13:47:46 +02:00
Zbigniew Jędrzejewski-Szmek 867cba15bc resolve: add converters for sshfp key types and algs
With the data center move in the Fedora project, the ssh keys have changed.
The list with numerical values is hard to read…

$ resolvectl -t sshfp query pkgs.fedoraproject.org
Old:
pkgs.fedoraproject.org IN SSHFP 1 1 18270c9131ef9664861f5aa675a981146573cce0 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP 1 2 b067e6eb4c3e2d0e8bb37d6799493b762131816fe979940bbe660470abe6efbb -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP 3 1 a1ad871a5eabe3027728d498a89895fb5bf5b290 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP 3 2 c3dc523f99bb5155ec87f40fd1aa198c68f349d75beeccf60e87b44c9b461907 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP 4 1 e1265f46012ee40967127e06cf5533b270568428 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP 4 2 acaa1ee6292d01f1ae7881fdf03aaf7d7b0814e34e94c3558a25e4d1aaab8f94 -- link: wlp0s20f3
New:
pkgs.fedoraproject.org IN SSHFP RSA     SHA-1   18270c9131ef9664861f5aa675a981146573cce0 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP RSA     SHA-256 b067e6eb4c3e2d0e8bb37d6799493b762131816fe979940bbe660470abe6efbb -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP ECDSA   SHA-1   a1ad871a5eabe3027728d498a89895fb5bf5b290 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP ECDSA   SHA-256 c3dc523f99bb5155ec87f40fd1aa198c68f349d75beeccf60e87b44c9b461907 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP Ed25519 SHA-1   e1265f46012ee40967127e06cf5533b270568428 -- link: wlp0s20f3
pkgs.fedoraproject.org IN SSHFP Ed25519 SHA-256 acaa1ee6292d01f1ae7881fdf03aaf7d7b0814e34e94c3558a25e4d1aaab8f94 -- link: wlp0s20f3
2025-07-03 13:46:40 +02:00
Yu Watanabe 33527a9b0c test-dns-search-domain: several cleanups
- use STRV_MAKE() macro,
- add several missing assertions,
- use more suitable ASSERT_XYZ() macros,
- drop TEST(dns_search_domain_unlink_all), as it is already tested in
  TEST(dns_search_domain_new_system_limit).
2025-07-03 08:46:26 +09:00
Yu Watanabe 549f679a49 basic: move missing_socket.h -> include/sys/socket.h 2025-07-01 12:27:59 +09:00
Zbigniew Jędrzejewski-Szmek 7d247d3cb8 meson: drop explicit custom_target names
[1] says:
> Since 0.60.0 the name argument is optional and defaults to the basename of
> the first output
We specify >= 0.62 as the supported version, so drop the duplicate name in all cases
where it is the same as outputs[0], i.e. almost all cases.

[1] https://mesonbuild.com/Reference-manual_functions.html#custom_target
2025-06-28 17:14:50 +02:00
Lennart Poettering 4b6dbd4ea5 resolved: don't wait for TLS close_notify replies unnecessarily
This is based on #35764 by Guruswamy Basavaiah, but covers further code
paths.

This ensures that when we initiate a TLS shutdown we'll write out our
own close_notify message, but not wait for the close_notify reply from
the server side anymore.

Replaces: #35764
2025-06-27 14:32:28 +01:00
Lennart Poettering 635b42edd9 resolved: when determining error to return, prefer "conclusive" over "inconclusive" errors
When asked to look something up, and all scopes we contact fail we need
to pick a suitable error code for the failure, and given that we look up
things on multiple scopes we might have multiple errors to choose from.
So far we simply picked the error from the last scope in the list, which
hence would be pretty arbitrary.

Let's tweak this a bit, and if we have multiple errors to choose from,
let's prefer "conclusive" failures over "inconclusive" ones. The
"inconclusive" ones in this sense are the ones where we didn't even issue
a request, but couldn't even do that because we had no server, no
network or things like that. The "conclusive" ones are the errors we got
from a server, that hence a "real" in a way.

This addresses the confusion described in #37969. For LLMNR lookups we
generally refuse looking up A addresses via IPv6 and AAAA via IPv4. This
generates a DNS_TRANSACTION_NO_SERVERS error, which we would then return
for one type of lookup but not for the other, because the IPv6 scope is
generally created after the IPv4 one, and hence so far won.

Fixes: #37969
2025-06-27 14:30:40 +01:00
Yu Watanabe 9a9139e087 test: use safe_glob() at one more place
This also makes the test use ASSERT_OK() and STRV_FOREACH() macros.

No functional change, just refactoring.
2025-06-23 23:11:44 +09:00
Lennart Poettering 884fb39f33 resolved: make bypass tests work
It's not sufficient to append a DNS key to a packet, we must also update
the qdcount too. We got this right in most tests but didn#t here.
Moreover, we must extract the packet then to actually have a DnsQuestion
properly filled in.

Fix that. Without this the tests didn't test anything reasonable.
2025-06-19 18:30:06 +02:00
Lennart Poettering 576a2bc79b resolved: honour RefuseRecordTypes= also in proxy mode
Fixes: #36491
2025-06-19 18:02:54 +02:00
Lennart Poettering 95625f3cb6 resolved: use dns_question_isempty() where appropriate 2025-06-19 18:02:53 +02:00
Lennart Poettering 2aacaf81e1 resolved: split out helper that determines on RefuseRecordTypes= match 2025-06-19 18:02:24 +02:00
Lennart Poettering 9ea5a6e7d6 fs-util: replace symlink_atomic_full_label() by a flag to symlinkat_atomic_full()
More porting work to label_ops_pre()/label_ops_post()

This also enables labelling of the /etc/localtime symlink in
systemd-firstboot, which should address one small facet of #37857
2025-06-18 10:21:25 +02:00
George Tsiamasiotis c60d2a626b resolved: Tweak link-local addresses relevancy
We now consider link-local addresses routable when we have configured
unicast link-local dns servers. This allows creating the DNS scope, even
when the interface doesn't get a routable address.
2025-06-18 04:57:27 +09:00
Yu Watanabe 752cdf5051 manager: also restart stub listner on reload
Previously, the extra stub listners were stopped but new ones were not
started. Also, the main stub listners were not restarted, hence the
new settings were not applied. This fixes the above two issues.

Note, to fix the issue, we need to keep CAP_NET_BIND_SERVICE capability
to make it allow to bind stub listner later.

Fixes #37843.
2025-06-16 22:02:30 +09:00
Yu Watanabe 9ed99b0793 resolve: several cleanups for manager_dispatch_reload_signal()
- set defaults after all existing configs and setups cleared,
- mention failures are ignored in log messages,
- drop one redundant log message,
- do not return negative errno but exit event loop on critical failure.
2025-06-16 22:02:30 +09:00
Yu Watanabe 872603b583 resolve: several cleanups for manager_new()
- mention the error is ignored in the log message,
- drop redundant log message, as dnssd_load() logs on failure,
- voidify manager_load_delegates().
2025-06-16 22:02:30 +09:00
Yu Watanabe 450a4edfc3 resolve: coding style fix 2025-06-16 22:02:30 +09:00
Yu Watanabe 5d5edcd3f4 resolve: fix indentation 2025-06-16 22:02:30 +09:00
Lennart Poettering 373e6cdadb resolved: ignore mDNS replies from legacy mDNS ports
mDNS replies always have to come from the mDNS port (unlike mDNS
queries, which are also allowed from non-mDNS ports). Hence refuse this.

Fixes: #33806
2025-06-11 00:33:05 +01:00
Yu Watanabe 5814acca9a resolve: exit from loop for transactions when transactions has been regenerated
Fixes #37458.
2025-06-10 17:30:03 +01:00
Yu Watanabe 3b1850d906 Bugprone argument comment 10 (#37755)
Follow up from https://github.com/systemd/systemd/pull/37712
2025-06-06 06:07:05 +09:00
Lennart Poettering 231a0417cd resolvectl: improve error message if we do not support dumping payload of RR 2025-06-05 12:43:36 +02:00
Lennart Poettering 141894f53a resolvectl: output slightly more data when --raw=payload is used
Let's also show A/AAAA data in binary form if --raw=payload is used. For
these RR types there's only a single data field, hence it's obbviously
meant.

Inspired by: #37737
2025-06-05 12:38:28 +02:00
Jelle van der Waa 63b21f503d resolved-manager: rename 's' -> 'source' 2025-06-04 15:49:26 +02:00
Yu Watanabe 6e47959685 Bugprone argument comment 9 (#37712)
Follow up from https://github.com/systemd/systemd/pull/37678
2025-06-04 22:33:51 +09:00
Lennart Poettering 959d7f1759 resolved: honour SD_RESOLVED_NO_CNAME flag when processing cache
Fixes: #33300
Replaces: #35102
2025-06-04 12:52:11 +01:00
Jelle van der Waa ac3a403486 treewide: correct argument comments for sd_event_add_time 2025-06-04 13:32:24 +02:00
Zbigniew Jędrzejewski-Szmek 42ba99748d various: do not include file names directly in error messages
git grep -l 'Failed to open /'|xargs sed -r -i 's|"Failed to open (/[^ ]+): %m"|"Failed to open %s: %m", "\1"|g'
git grep -l $'Failed to open \'/'|xargs sed -r -i $'s|"Failed to open \'(/[^ ]+)\': %m"|"Failed to open %s: %m", "\\1"|g'
git grep -l "Failed to open /"|xargs sed -r -i $'s|"Failed to open (/[^ ]+), ignoring: %m"|"Failed to open %s, ignoring: %m", "\\1"|g'
+ some manual fixups.
2025-06-02 11:10:38 +02:00
Daan De Meyer 5ea01af240 meson: Use .inc for generated code meant to be included in other files
These files use the .h extension but are not standalone so let's not
make it appear like they are proper headers and instead use the .inc
extension.
2025-05-22 11:25:29 +02:00
Daan De Meyer 284d76414e resolve: Clean up includes
Split out of #37344.
2025-05-21 23:50:31 +09:00
Daan De Meyer 9f74f56f36 test-tables: Pass enum type to test_table() as well
clang-include-cleaner has a hard time figuring out unused includes
with all the macro string concatentation we're doing in test_table().
Let's help it out a little by also passing the enum type into test_table().

While technically not needed, this makes the tests a bit more self-descriptive
and not really much more verbose so it feels like a good chance regardless,
even if the primary purpose is to help clang-include-cleaner figure out
used and unused includes.
2025-05-21 13:24:42 +02:00
Yu Watanabe ef27ebab08 Clean up more includes (#37527)
Split out of #37344
2025-05-21 19:43:39 +09:00
Jelle van der Waa 00299a80f7 sd-event: rename 's' -> 'ret' 2025-05-21 10:50:25 +02:00
Daan De Meyer 8b5ce49591 basic: Include time-util.h in constants.h
constants.h defines a bunch of constants that use macros from
time-util.h, so add the needed include. To avoid cyclic dependencies,
we move the HAS_FEATURE_MEMORY_SANITIZER and HAS_FEATURE_ADDRESS_SANITIZER
logic to macro.h and get rid of the constants.h include there.

The rest of this commit is adding missing constants.h includes where
needed due to it being removed from macro.h.
2025-05-21 10:49:42 +02:00
Lennart Poettering 45817e9245 resolvectl: show delegate information, too 2025-05-20 23:00:53 +02:00
Lennart Poettering 5c45b341d3 resolvectl: rework parsing of dns server + search domain bus properties
Let's handle the per-link and the global dns server/search domain
property parsing the same. Let's use a flags field for three separate
booleans, and unify more code.
2025-05-20 23:00:53 +02:00
Lennart Poettering 7928c0e0a1 resolved: add concept of delegating lookups below certain domains to specific DNS servers
This permits configuration of additional "delegates" which ensure that
lookups for certain DNS zones are routed to specific sets of DNS
servers, in addition to the routes we create for each network interface.

For now, this allows only static configuration, but eventually we should
open this up to IPC.

Fixes: #5573 #14159 #20485 #21260 #24532 #32022

(Fixes #32022, because now redundant)
2025-05-20 23:00:03 +02:00
Lennart Poettering 6a198b4382 resolved: add a new DnsScopeOrigin enum, to delcare the "origin" of a DnsScope explicitly
This new enum field is supposed to indicate why a DnsScope came to be.
For now it distinguishes two origins: the "global" one (which is what is
configured in resolved.conf) and "link" ones (which are synthesized for
each link).

The field as is is pretty redundant, the same information can be
determined from whether the .link field is set or not.

This is pretty much just preparation for later commits that add
statically configured additional DnsScopes whose origin shall be encoded
with this.
2025-05-20 22:58:44 +02:00
Daan De Meyer 5fff57362e meson: Use hyphens everywhere in gperf.c filenames 2025-05-20 10:46:28 +02:00
Daan De Meyer a583b34416 meson: Extract more objects instead of compiling multiple times
Also, let's deflatten the lists of sources in preparation for the
next commit at the same time.

In systemctl, we split out systemctl-main.c to make sure the definition
of main() is in a separate object which allows us to extract the systemctl.c
object and link it in the fuzzer target without getting a multiple definition
error when linking.
2025-05-20 10:29:58 +02:00
Daan De Meyer ef10d4b526 Bugprone argument comment - round 5 (#37481) 2025-05-15 20:33:50 +02:00
Jelle van der Waa 346c62f9ca treewide: correct argument comments 2025-05-15 15:39:20 +02:00
Lennart Poettering 8d7d2edcbb bus-polkit: add a generic vtable for methods with no params, but with polkit 2025-05-15 09:31:27 +02:00
Yu Watanabe 231557fe40 resolve: fix typo
Follow-up for 801ad6a6a9.
2025-05-15 07:19:24 +09:00
André Monteiro 02527e95b5 Add dns0.eu in resolved.conf.in (#37404)
Add dns0.eu as a dns option in resolved.conf.in
This also adds Quad9 DNS servers as the default fallback servers.
2025-05-13 08:36:22 +09:00
Daan De Meyer 6350d2dbd9 meson: Extract objects instead of creating intermediate static libraries
Currently, when we want to add unit tests for code that is compiled into
an executable, we either compile the code at least twice (once for the
executable, and once for each test that uses it) or we create a static
library which is then used by both the executable and all the tests.

Both of these options are not ideal, compiling source files more than
once slows down the build for no reason and creating the intermediate
static libraries takes a lot of boilerplate.

Instead, let's use the extract_objects() method that meson exposes on
build targets. This allows us to extract the objects corresponding to
specific source files and use them in other executables. Because we
define all executables upfront into a dictionary, we integrate this into
the dictionary approach by adding two new fields:

- 'extract' takes a list of files for which objects should be extracted.
  The extracted objects are stored in a dict keyed by the executable name
  from which they were extracted.
- 'objects' takes the name of an executable from which the extracted
  objects should be added to the current executable.

One side effect of this approach is that we can't build test executables
anymore without building the main executable, so we stop building test
executables unless we're also building the main executable. This allows
us to switch to using subdir_done() in all of these subdirectories to skip
parsing them if the corresponding component is disabled.

These changes get me down from 2439 => 2403 ninja targets on a full rebuild
from scratch.
2025-05-12 13:35:50 +02:00
Daan De Meyer 180ea8b3ab More header cleanups (#37381) 2025-05-09 17:22:33 +02:00
Daan De Meyer 3b7d332047 macro: Reduce transitive includes 2025-05-09 11:33:31 +02:00