This also makes IPv4 proxy neighbor entries independent of proxy_arp
sysctl. We can configure IPv4 proxy neighbor entries even if proxy_arp
is disabled.
Even though the document says "When unset, the kernel's default will
be used." for IPv6ProxyNDP=, previously, when both IPv6ProxyNDP= and
IPv6ProxyNDPAddress= are unspecified, proxy_ndp sysctl was disabled.
This was also inconsistent to other sysctl settings.
It is not necessary to provide dedicated settings for IPv4 and IPv6
proxy neighbor entries. Let's unify them.
The IPv4ProxyARPAddress= setting was introduced after v261. Hence, we
can freely rename it.
Provides a Tokio-like #[tokio::main] entry point for binaries that want
to run their main function inside a fiber on a default sd_event loop.
DEFINE_MAIN_FUNCTION_FIBER(impl) mirrors DEFINE_MAIN_FUNCTION but routes
impl through a new run_main_fiber() helper, which:
- allocates the default sd_event,
- enables exit-on-idle so the loop terminates once all event sources
drain (structured concurrency: impl is expected to cancel and reap
whatever it spawned before returning),
- spawns impl as a fiber named after program_invocation_short_name,
- installs SIGINT/SIGTERM handlers that cancel the main fiber (and
disable themselves so the loop can go idle once the fiber unwinds),
- runs sd_event_loop and propagates impl's return value via
sd_future_result, normalising -ECANCELED to 0 since that just
represents an orderly signal-driven shutdown.
With DNSSEC on, resolved can't validate anything until the clock is
correct,
and without an RTC the only thing that fixes the clock is talking to the
NTP servers we're trying to resolve.
On glibc the timesyncd unit sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 and
nss-resolve turns that into a per-query flag, which breaks the
chicken/egg. musl and systems not using nss-resolve have no NSS, so
nothing
reads it there and we're stuck.
So talk to resolved directly when it's there, and pass
SD_RESOLVED_NO_VALIDATE until we've synced the clock ourselves. Lookups
after that are validated normally, which is better than what we get from
nss. If resolved isn't around we keep using getaddrinfo().
Tested on musl in qemu with the RTC set to 2020 and DNSSEC=yes.
timesyncd syncs when it couldn't before, while `resolvectl query` still
fails with signature-expired, so the "relaxation" is scoped to only
timesyncd.
Once the clock is synced subsequent timesyncd resolver queries no longer
include the flag to disable validation.
fixes#20235
The 'changed' variable is either unused on error or unconditionally
overwritten on success, so coverity warns about it. Drop the unused
assignment.
CID#1685266
Follow-up for a572dd2f60
ipv6_is_supported only tells us the kernel has IPv6, not that
it's usable. ipv6_is_enabled also checks the sysctl that turns
it off, so we stop resolving addresses we can't use.
Our first resolve happens way before sockets.target, and
systemd-resolved-varlink.socket has no ordering of its own, so there's
nothing making sure the socket is listening by then. Without this the
connect fails and we quietly fall back to getaddrinfo(), which is exactly
the case the varlink path is there for.
Order after both the service and the socket since either one is enough
on its own but neither covers every install situation. For example
resolved binds the socket itself when nothing hands it one, and on
systems where only the socket is enabled the service isn't started at
boot at all.
With DNSSEC on, resolved can't validate anything until the clock is
right, and without an RTC the only thing that fixes the clock is talking
to the NTP servers we're trying to resolve. On glibc the timesyncd unit
sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 and nss-resolve turns that into a
per-query flag, which breaks the chicken/egg. musl (and other systems
not using nss-resolve) have no NSS, so nothing reads it there and we're
stuck.
So talk to resolved directly when it's there, and pass
SD_RESOLVED_NO_VALIDATE until we've synced the clock ourselves.
NTP-related lookups after that are validated normally, which is better
than what we get from nss. If resolved isn't around we just keep using
getaddrinfo().
The reply handler duplicates the tail of the getaddrinfo handler, since
the two differ in how they report failures. Varlink discards what the
callback returns, so it has to move on to the next host itself.
This also drops SYSTEMD_NSS_RESOLVE_VALIDATE=0 from the unit because
nss-resolve talks to resolved over the same socket we do, so the
getaddrinfo() path is only ever taken when resolved is unreachable, and
then nothing validates anyway.
`sd_dhcp_server_configure_pool()` calculated the maximum pool size
before checking whether `PoolOffset=` was inside the subnet.
Because the calculation used unsigned arithmetic, an offset beyond the
broadcast address could wrap around to a large value and pass validation.
For example, `PoolOffset=256` with a `/24` and `PoolSize=1` was accepted,
allowing the DHCP server to offer an address outside its configured subnet.
Reject offsets at or beyond the broadcast address before performing the
subtraction, and calculate the remaining pool size directly as
`broadcast_off - offset`.
BrowseServices(ifindex=0) may observe the same service on multiple
links. Treat the link index as part of the discovered service
identity so add and remove events remain link-scoped.
Use the per-service ifindex for RFC 6762 maintenance queries.
Share the service identity predicate between add and remove handling,
and propagate RR comparison errors instead of reporting removals.
Extend coverage for scoped-browser ifindex fallback, goodbye TTL
handling, and monotonic expiry updates.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. --help now goes through the pager, like other
commands with --no-pager.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The synopsis now also lists the --list mode,
matching the man page. --help now goes through the pager, like other
commands with --no-pager.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is left as it was, nonimperative.
I tried a few different forms but couldn't find one that was clearly
better.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The synopsis is updated to be more truthful
and consistent between the prog and man page.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. --help now goes through the pager, like other
commands with --no-pager.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. --help now goes through the pager, like other
commands with --no-pager.
Synopses are adjusted. --user-unit/--unit without any unit names is
technically allowed, but not very meaningful, since it's the same as
the default mode. So [] is dropped. And the prog help string is then
adjusted to match the man page.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. "COMMAND…" is marked as optional, since
'cat' is the default verb.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is changed to use the imperative
form ("Register …" instead of "Registers …"), consistent with the other
commands. --help now goes through the pager, like other commands with
--no-pager.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is changed to use the imperative
form ("Configure …" instead of "Configures …"), consistent with the
other commands.
After c9cd66ee3a and
c81b5d36b9, the comment about systemd-backlight
and systemd-veritysetup was outdated. We can test them as any other program.
Also, use an array to make list easier to extend in the future and
adjust $PATH so we don't need to care about the split between public
and non-public programs.
PID, UID, and GID are converted by sending struct ucred, however, TID
was not converted. Let's convert TID if corresponding pidfd exists, and
discards TID otherwise.
Fixes 4c7af7d9d1.
Since kernel v6.19, ioctl(PIDFD_GET_INFO) can return the set of
supported flags when PIDFD_INFO_SUPPORTED_MASK is specified.
This allows checking whether, e.g., PIDFD_INFO_COREDUMP_SIGNAL is
supported by the running kernel.
PID, UID, and GID are converted by sending struct ucred, however,
TID was not converted. Let's convert TID if corresponding pidfd exists,
and discards TID otherwise.
Fixes 4c7af7d9d1.
The connect callback is called after sd_varlink_server_add_connection()
succeeds. Do not call the disconnect callback for connections that have
not been established yet.
Previously, sd_varlink_server_add_connection_pair() did not decrement
the connection counters when json_stream_attach_fds() failed.
Set the ucred before calling json_stream_attach_fds() so that
sd_varlink_close() also decrements the counters when it fails.
This makes json_stream_attach_fds() and json_stream_connect_fd_pair()
leave the passed file descriptors with the caller on failure. Callers
should call TAKE_FD() only after a successful call.
Also make qmp_client_connect_fd() always take ownership of the passed
file descriptor, including on failure. Previously, ownership of the
passed file descriptor on failure was unclear and depended on where
the function failed.
Provide a Tokio-like #[tokio::main] entry point for binaries that want to run
their main function inside a fiber on a default sd_event loop.
DEFINE_MAIN_FUNCTION_FIBER(impl) mirrors DEFINE_MAIN_FUNCTION but routes impl
through a new run_main_fiber() helper. impl keeps the run() convention while
the loop's exit code keeps the exit status convention: impl's result never
becomes an exit code, an explicit exit status wins over a successful impl, and
impl's own failure wins over the exit status unless it is the -ECANCELED of a
fiber that the exit request cancelled. Signal policy stays with impl so
existing handlers such as sd_event_set_signal_exit() keep working.
The fiber is created fire-and-forget: as long as the loop reaches
SD_EVENT_FINISHED it unwinds the fiber through its exit event source, so we
never hold a reference we cannot drop because the fiber is still suspended. A
loop that fails internally never dispatches its exit sources, so the fiber may
stay suspended with no working loop left to unwind it; we leak both for now and
leave a TODO to keep the broken loop out of the default slot. Since the fiber
also refers to run_main_fiber()'s stack frame, refuse to run on a loop we don't
own, or from a fiber, as sd_fiber_new() leaves the exit event source disabled
there and nothing would unwind the fiber.
Cover argument forwarding, result propagation, explicit event exits, nested
invocations, signal-source registration, event-loop errors, and fiber stack
unwinding, and check after every run that the default event loop was released
again. Also build and run a separate test executable that expands
DEFINE_MAIN_FUNCTION_FIBER itself and verifies that a positive implementation
result maps to a successful process exit.
The getty.auto credential is a textual configuration value, but credentials
are read as raw file contents. A value written by common text-file workflows
can therefore end in a newline, causing false\n to be rejected and ignored.
Reproducer:
printf 'false\n' > "$CREDENTIALS_DIRECTORY/getty.auto"
Before: getty units could still be generated because the credential was
ignored as invalid.
Expected: false\n is parsed the same as false and disables getty
generation.
Strip the value in getty-generator before parsing it. This keeps the
credential framework byte-preserving while applying text semantics where
getty.auto is consumed.
Follow-up for: 3a883e89bc
Yu Watanabe
Luca Boccassi
Pétur
Clayton Craft
Anton Tiurin
dongshengyuan
Lefteris T
Zbigniew Jędrzejewski-Szmek
ShiroKSH
Daan De Meyer