Previously, only servers that statically configursd or obtained by
DHCPv4 protocol are saved in the manager state file.
NTP servers obtained by DHCPv6 could not be used by timesyncd.
Fixes#29148.
Some qdiscs (e.g. tbf) implicitly create class(es) on create.
Previously, we could not create any child qdisc under the class, as the
implicit class is tagged as foreign.
Some kind of qdisc implicitly creates a class for the qdisc, but the
created class is not notified by the kernel. So, we need to explicitly
enumerate classes after a qdisc is created.
When a node of traffic control tree is removed, all child nodes are also
removed but their removal are not notified by the kernel.
So, previously, removed TC classes or qdiscs under the removed node were
kept in the memory of networkd, and may cause failure on reconfigure.
In sd-dhcp-client.c, we do not set the option in the DHCPDISCOVER
message when anonymized, and the specified address is ignored
anyway. So, this does not change the behavior, but suppress
misleading debugging log in dhcp4_set_request_address().
New directive `NFTSet=` provides a method for integrating dynamic cgroup IDs
into firewall rules with NFT sets. The benefit of using this setting is to be
able to use control group as a selector in firewall rules easily and this in
turn allows more fine grained filtering. Also, NFT rules for cgroup matching
use numeric cgroup IDs, which change every time a service is restarted, making
them hard to use in systemd environment.
This option expects a whitespace separated list of NFT set definitions. Each
definition consists of a colon-separated tuple of source type (only "cgroup"),
NFT address family (one of "arp", "bridge", "inet", "ip", "ip6", or "netdev"),
table name and set name. The names of tables and sets must conform to lexical
restrictions of NFT table names. The type of the element used in the NFT filter
must be "cgroupsv2". When a control group for a unit is realized, the cgroup ID
will be appended to the NFT sets and it will be be removed when the control
group is removed. systemd only inserts elements to (or removes from) the sets,
so the related NFT rules, tables and sets must be prepared elsewhere in
advance. Failures to manage the sets will be ignored.
If the firewall rules are reinstalled so that the contents of NFT sets are
destroyed, command systemctl daemon-reload can be used to refill the sets.
Example:
```
table inet filter {
...
set timesyncd {
type cgroupsv2
}
chain ntp_output {
socket cgroupv2 != @timesyncd counter drop
accept
}
...
}
```
/etc/systemd/system/systemd-timesyncd.service.d/override.conf
```
[Service]
NFTSet=cgroup:inet:filter:timesyncd
```
```
$ sudo nft list set inet filter timesyncd
table inet filter {
set timesyncd {
type cgroupsv2
elements = { "system.slice/systemd-timesyncd.service" }
}
}
```
The macro used to return NULL if input was NULL or had the wrong type. Now
it asserts that input is nonnull and it has the expected type.
There are a few places where a missing or mismatched type was OK, but in a
majority of places, we would do both of the asserts. In various places we'd
only do one, but that was by ommission/mistake. So moving the asserts into the
macro allows us to save some lines.
We have two fields: inherit and ttl, and ttl is ignored if inherit is true.
Setting TTL=inherit and later TTL=n would not work because we didn't unset
inherit.
Previously, we would call parse_ip_protocol(), which internally calls
safe_atoi(), and then call safe_atou(). This isn't terrible, but it's also
slightly confusing. Use parse_ip_protocol_full() to avoid the second call.
This compresses repetetive code and makes it easier to add new options
in networkd. The formatting of error messages becomes uniform. The
error message always specifies the rvalue literally, instead of using
a "descriptive name". This makes the message much easier to handle for
the user.
I opted to add just one parser, and wrap it with inline functions to proxy
the type. This is less verbose than copying functions for each type
separately, and the compiler should be able to get rid of the inline wrapper
almost entirely.
asserts are reordered to use the same order as the parameter list.
This makes the code easier to read.
No functional change intended, apart from the difference in error message
formatting.
This splits sd_dhcp6_lease_get_address() into small pieces,
and introduce FOREACH_DHCP6_ADDRESS() macro.
Also, the lifetimes provided by _get_address_lifetime() are now in usec,
and _get_address_lifetime_timestamp() provides timestamp.
The same change is also applied for IA_PD.
Previously, even if a .network file contains multiple IPv6 null
addresses with different prefix length, only the first setting is applied,
as the remainings are deduped in network_drop_invalid_addresses().
Even though the kernel allows us to change the prefix length of an existing
IPv6 address, we cannot safely change the prefix length of an address
that is originally requested as a null address, as the prefix of the
address may conflict with other addresses if we change it.
We already prohibit to change the prefix length of an existing IPv6
address that is originally requested as a null address. So, we can
safely allow to configure multiple IPv6 addresses from null addresses by
relaxing the dedup logic. The dedup is govern by the hash_ops. This adds
a special handling for IPv6 null addresses.
Yu WatanabeandSusant Sahani
Mike Yuan
Luca Boccassi
Daan De Meyer
Topi Miettinen
Zbigniew Jędrzejewski-Szmek
Franck Bui