Joan Bruguera
aa892849d5
resolved: Avoid multiple SSL writes per DoT packet
...
In the DoT case, dns_stream_writev decomposed an iovec into multiple
dnstls_stream_write calls, which resulted in multiple SSL writes and multiple
TLS records. This can be checked from a network capture, e.g. using socat:
socat -v -x openssl-listen:853,reuseaddr,fork,cert=my.cert,key=my.key,verify=0 openssl:8.8.8.8:853
Instead, propagate the iovec as-is into the DoT handling code. For GnuTLS, the
library provides support for buffering ('corking') a record. OpenSSL has no
such facility, so we join the iovec into a single buffer then call SSL_write.
socat capture of `resolvectl -4 query --cache=no example.com` before the commit:
> 2022/01/30 13:35:52.194200 length=2 from=0 to=1
00 28 .(
--
> 2022/01/30 13:35:52.194253 length=40 from=2 to=41
1e b2 01 00 00 01 00 00 00 00 00 01 07 65 78 61 .............exa
6d 70 6c 65 03 63 6f 6d 00 00 01 00 01 00 00 29 mple.com.......)
ff e4 00 00 00 00 00 00 ........
--
< 2022/01/30 13:35:52.232798 length=58 from=0 to=57
00 38 1e b2 81 80 00 01 00 01 00 00 00 01 07 65 .8.............e
78 61 6d 70 6c 65 03 63 6f 6d 00 00 01 00 01 c0 xample.com......
0c 00 01 00 01 00 00 53 6f 00 04 5d b8 d8 22 00 .......So..]..".
00 29 02 00 00 00 00 00 00 00 .)........
socat capture of `resolvectl -4 query --cache=no example.com` after the commit:
> 2022/01/30 13:34:47.598099 length=42 from=504 to=545
00 28 37 86 01 00 00 01 00 00 00 00 00 01 07 65 .(7............e
78 61 6d 70 6c 65 03 63 6f 6d 00 00 01 00 01 00 xample.com......
00 29 ff e4 00 00 00 00 00 00 .)........
--
< 2022/01/30 13:34:47.613203 length=58 from=756 to=813
00 38 37 86 81 80 00 01 00 01 00 00 00 01 07 65 .87............e
78 61 6d 70 6c 65 03 63 6f 6d 00 00 01 00 01 c0 xample.com......
0c 00 01 00 01 00 00 52 5e 00 04 5d b8 d8 22 00 .......R^..]..".
00 29 02 00 00 00 00 00 00 00 .)........
2022-02-01 19:24:40 +01:00
Joan Bruguera
eff107736e
resolved: Make event flags logic robust for DoT
...
Since when handling a DNS over TLS stream, the TLS library can override the
requested events through dnstls_events for handshake/shutdown purposes,
obtaining the event flags through sd_event_source_get_io_events and checking
for EPOLLIN or EPOLLOUT does not really tell us whether we want to read/write
a packet. Instead, it could just be OpenSSL/GnuTLS doing something else.
To make the logic more robust (and simpler), save the flags that tell us
whether we want to read/write a packet, and check them instead of the IO flags.
(& use uint32_t for the flags like in sd_event_source_set_io_events prototype)
2022-02-01 19:24:40 +01:00
Lennart Poettering
bb7031bcaa
NEWS: minor formatting tweaks
2022-02-01 17:59:49 +01:00
Luca Boccassi
a1cad433bd
Merge pull request #22341 from poettering/pam-end-fix
...
pid1: pam_end() PAM_DATA_SILENT fix
2022-02-01 16:34:00 +00:00
Lennart Poettering
007e03b284
util: another set of CVE-2021-4034 assert()s
...
It's a good idea that we validate argc/argv when we are supposed to
store them away.
2022-02-01 14:44:08 +00:00
Luca Boccassi
98fd285c28
Merge pull request #22331 from yuwata/network-xfrm-interface-id
...
network: xfrm: refuse zero interface ID
2022-02-01 13:25:38 +00:00
Lennart Poettering
421bb42d1b
execute: document that the 'env' param is input *and* output
2022-02-01 13:50:28 +01:00
Lennart Poettering
cafc5ca147
execute: line break comments a bit less aggressively
2022-02-01 13:50:13 +01:00
Lennart Poettering
46e5bbab58
execute: use _cleanup_ logic where appropriate
2022-02-01 13:49:56 +01:00
Lennart Poettering
7feb2b5737
pid1: pass PAM_DATA_SILENT to pam_end() in child
...
Fixes : #22318
2022-02-01 12:37:51 +01:00
Yu Watanabe
bab29f2ab7
network: dhcp-server: also refuse link local address to use as the server address
2022-02-01 11:18:53 +00:00
Yu Watanabe
b0f83c2d82
Merge pull request #22254 from yuwata/dhcp-server-fix-segfault
...
sd-dhcp-server: remove lease with hashmap_remove_value()
2022-02-01 14:10:11 +09:00
Yu Watanabe
a8dfcd2c0f
Merge pull request #22319 from yuwata/network-use-reconfigure
...
network: also use link_reconfigure_impl() to initially assign .network file
2022-02-01 14:09:32 +09:00
Yu Watanabe
020483b248
test-network: set xfrm interface ID
...
This also unifies two tests for xfrm, and checks the output of
'ip link' command.
Fixes #22329 .
2022-02-01 13:26:43 +09:00
Yu Watanabe
fd11005951
network: xfrm: refuse zero interface ID
...
Since kernel 5.17-rc1, 5.16.3, and 5.15.17 (more specifically,
https://github.com/torvalds/linux/commit/8dce43919566f06e865f7e8949f5c10d8c2493f5 )
the kernel refuses to create an xfrm interface with zero ID.
2022-02-01 13:15:11 +09:00
James Hilliard
04660b10d3
meson: use full argument names for bpftool gen commands
...
This should be a purely cosmetic change.
2022-02-01 12:26:30 +09:00
Yu Watanabe
a46abf2e34
fuzz-dhcp-server: add static leases
2022-02-01 11:56:22 +09:00
Yu Watanabe
6796c5a9c4
test-dhcp-server: add tests for static lease
2022-02-01 11:56:22 +09:00
Yu Watanabe
7b5445e74e
test-dhcp-server: add tests for setting static DHCP lease
2022-02-01 11:56:22 +09:00
Yu Watanabe
99e65b7df3
test-dhcp-server: add usual headers
2022-02-01 11:56:22 +09:00
Yu Watanabe
4f3cb2465a
test-dhcp-server: run a test earlier which does not require privilege
2022-02-01 11:56:22 +09:00
Yu Watanabe
4e2319afe4
test-dhcp-server: move sd-event allocation
2022-02-01 11:56:22 +09:00
Yu Watanabe
7e0a8bf1ce
test-dhcp-server: use log_tests_skipped_errno()
2022-02-01 11:56:22 +09:00
Yu Watanabe
8b572f7ab2
sd-dhcp-server: split out logic to ACK request
2022-02-01 11:56:22 +09:00
Yu Watanabe
bd1a3eb65b
sd-dhcp-server: do not assign address reserved for static leases to non-matching clients
...
This fix the root cause of the issue #22253 .
2022-02-01 11:56:22 +09:00
Yu Watanabe
7e98fe05a0
sd-dhcp-server: explicitly refuse when conflicting address is requested
2022-02-01 11:56:22 +09:00
Yu Watanabe
e2ba408084
sd-dhcp-server: do not assign an address from pool when a static lease for the client ID exists
2022-02-01 11:56:22 +09:00
Yu Watanabe
5cc8be890d
sd-dhcp-server: rename get_pool_offset() -> address_is_in_pool()
...
As, the value of pool_offset is not used.
2022-02-01 11:56:22 +09:00
Yu Watanabe
eb5bff9c9d
sd-dhcp-server: rename server_send_nak() -> server_send_nak_or_ignore()
...
And logs error in the function.
2022-02-01 11:56:01 +09:00
Yu Watanabe
8a7d048d1d
sd-dhcp-server: set DHCPLease::server before hashmap_put()
...
Otherwise, if the second push is failed, then the first hashmap contains
dirty entry.
Also, this makes hashmap_remove_value() used when removing leases to
make not wrong lease is removed from the hashmap.
Note, this just hide the root cause of the issue #22253 , which will be
fixed in later commit.
Fixes #22253 .
2022-02-01 11:45:51 +09:00
Yu Watanabe
37e219800f
sd-dhcp-server: fix indentation
2022-02-01 11:45:51 +09:00
Yu Watanabe
48be485b71
sd-dhcp-server: rename argument and add one missing assertion
2022-02-01 11:45:51 +09:00
Yu Watanabe
6277e48fa9
sd-dhcp-server: do not use implicit cast to boolean from integer
2022-02-01 11:45:51 +09:00
Yu Watanabe
a2a801926d
sd-dhcp-server: refuse zero length client ID
2022-02-01 11:45:51 +09:00
Yu Watanabe
0a195d4186
sd-dhcp-server: do not log "STOPPED" when already stopped
2022-02-01 11:45:51 +09:00
Yu Watanabe
fb96111946
network: also use link_reconfigure_impl() to initially assign .network file
2022-02-01 11:38:01 +09:00
Yu Watanabe
bb193d2df2
network: drop tiny wrapper used only one place anymore
2022-02-01 11:37:45 +09:00
Yu Watanabe
3cf58ef316
network: do not free bound_by carrier map on reconfigure
...
Otherwise, if a link enters unmanaged state, then its carrier state does
not propagated to other interfaces.
2022-02-01 11:37:01 +09:00
Yu Watanabe
b69bfa4305
network: do not remove localhost address
...
Managing loopback interfaces by networkd is not recommended, but supporeted.
Even such spurious situation, do not drop the localhost addresses.
2022-02-01 11:30:37 +09:00
Yu Watanabe
259c65f36c
network: move ndisc_flush() to link_stop_engines()
...
As it is not related to any static configs.
2022-02-01 11:30:37 +09:00
Yu Watanabe
a0e99a377a
network: remove only managed configs on reconfigure or carrier lost
...
Otherwise, if the carrir of the non-managed interface is lost, the
configs such as addresses or routes on the interface will be removed by
networkd.
2022-02-01 11:30:37 +09:00
Luca Boccassi
9d67fb0e33
Merge pull request #22175 from keszybz/kernel-install-mkosi-initrd
...
kernel-install: add support for KERNEL_INSTALL_INITRD_GENERATOR and KERNEL_INSTALL_STAGING_AREA
2022-01-31 23:09:46 +00:00
Frantisek Sumsal
e3d1ffcc48
network: s/confiured/configured/
...
A quick typo fix I noticed whilst debugging.
2022-01-31 23:07:41 +00:00
Lennart Poettering
69339ae9f7
tree-wide: some additional checks to avoid CVE-2021-4034 style weaknesses
2022-01-31 23:07:19 +00:00
Lennart Poettering
e5b90b30c2
random-seed: add missing %m in error message
2022-01-31 21:07:13 +00:00
Frantisek Sumsal
caeaca1b8f
Merge pull request #22323 from mrc0mmand/fix-TEST-69-on-C8S
...
test: use ~/.bashrc instead of /etc/bash.bashrc
2022-01-31 19:04:02 +00:00
Lennart Poettering
594f64f466
update TODO
2022-01-31 18:14:34 +01:00
Frantisek Sumsal
6f73ef8b30
test: copy portable profiles into the image if they don't exist there
...
If we're built with `-Dportable=false`, the portable profiles won't get
installed into the image. Since we need only the profile files and
nothing else, let's copy them into the image explicitly in such case.
2022-01-31 17:09:30 +00:00
Frantisek Sumsal
1f450a680f
test: use ~/.bashrc instead of /etc/bash.bashrc
...
/etc/bash.bashrc appears to be Debian-specific[0] (or specific to bash
versions compiled with -DSYS_BASHRC), which doesn't seem to be the case
for C8S. Let's use ~/.bashrc instead to make the CIs happy again.
[0] https://sources.debian.org/src/bash/5.1-6/debian/README/#L50-L56
2022-01-31 17:47:01 +01:00
Frantisek Sumsal
db357e9a89
test: make the code less error-prone
2022-01-31 16:49:09 +01:00
Joan Bruguera
Lennart Poettering
Luca Boccassi
Yu Watanabe
James Hilliard
Luca Boccassi
Frantisek Sumsal