1
0
mirror of https://github.com/systemd/systemd.git synced 2024-10-31 07:51:21 +03:00
Commit Graph

379 Commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek
5fd8782328 fuzz-systemctl-parse-argv: a new fuzzer
Does what the name suggests. Obviously inspired by sudoers, but note that
our tools are not supposed to be installed suid, so there is no privilege
boundary to cross here.
2021-02-09 14:11:42 +01:00
Yu Watanabe
face9fcc16 network,udev: move TransmitQueues=/ReceiveQueues= from .network to .link
As the settings are mostly hardware setup, and merely see from network
layer.

See also discussions in
https://github.com/systemd/systemd/pull/18170#issuecomment-758807497
https://github.com/orgs/systemd/teams/systemd/discussions/1
2021-02-03 14:44:51 +09:00
Yu Watanabe
1f8dc96c06 udev: rename TxQueueLength= -> TransmitQueueLength=
As we usually (unfortunately not always though) do not use abbreviations.

Tx may be standard abbreviation, but we already have e.g.
TransmitChecksumOffload=. So, let's use Transmit instead of Tx.

Follow-up for ef4a91a7e8.
2021-02-03 14:43:49 +09:00
Topi Miettinen
ddc155b2fd New directives NoExecPaths= ExecPaths=
Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC`
mount flag for the file system tree. This can be used to implement file system
W^X policies, and for example with allow-listing mode (NoExecPaths=/) a
compromised service would not be able to execute a shell, if that was not
explicitly allowed.

Example:
[Service]
NoExecPaths=/
ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib

Closes: #17942.
2021-01-29 12:40:52 +00:00
Dan Streetman
61135582e0 network: add ActivationPolicy= configuration parameter
This parameter allows configuring the activation policy for an interface,
meaning how it manages the interface's administrative state (IFF_UP flag).
The policy can be configured to bring the interface either up or down when
the interface is (re)configured, to always force the interface either up or
down, or to never change the interface administrative state.

If the interface is bound with BindCarrier=, its administrative state is
controlled by the interface(s) it's bound to, and this parameter is forced
to 'bound'.

This changes the default behavior of how systemd-networkd sets the IFF_UP
flag; previously, it was set up (if not already up) every time the
link_joined() function was called. Now, with the default ActivationPolicy=
setting of 'up', it will only set the IFF_UP flag once, the first time
link_joined() is called, during an interface's configuration; and on
the first link_joined() call each time the interface is reconfigured.

Fixes: #3031
Fixes: #17437
2021-01-21 11:49:43 -05:00
Yu Watanabe
f9ead1a2f4
Merge pull request #18230 from ssahani/macvlan-bcqueuelen
network: macvlan - add support to configure rx queue for broadcast / multicast
2021-01-17 20:05:22 +09:00
Susant Sahani
dca0a4e131 network: macvlan - add support to configure rx queue for broadcast/multicast 2021-01-17 08:39:28 +01:00
Gaël PORTAY
0141102f10 veritysetup-generator: add support for verity root options
This adds support for a new kernel root verity command line option
"verity_root_options=" which controls the behaviour of dm-verity by
forwarding options directly to systemd-veritysetup.

See `veritysetup(8)` for more details.
2021-01-14 19:41:41 -05:00
Lennart Poettering
ce0079d75e
Merge pull request #18227 from yuwata/network-dhcp6-pd-manage-temporary-address
network: introduce ManageTemporaryAddress= setting in [DHCPv6PrefixDelegation] section
2021-01-13 21:52:44 +01:00
Yu Watanabe
fec1b650ad network: introduce ManageTemporaryAddress= setting in [DHCPv6PrefixDelegation] section
The setting is enabled by default, as NDisc also enabled the flag by
default.

Closes #18208.
2021-01-14 00:17:05 +09:00
Ulrich Ölmann
ef4a91a7e8 udev: introduce TxQueueLength= setting
Enable udev to set the transmit queue length of a device via a new directive to
be used in link files. The kernel stores this parameter as an unsigned 32 bit
integer. As typical values currently range in the order of 10 to a few 10,000
packets reduce the domain of valid values for this directive to 0..4294967294
and take the excluded 4294967295 == UINT32_MAX to indicate that the directive
is unset.
2021-01-13 06:41:06 +01:00
Yu Watanabe
048be097d2
Merge pull request #18157 from ssahani/vlan-qos
network: Allow to configure VLan egress qos maps
2021-01-13 05:42:53 +09:00
Yu Watanabe
7c5869530c
Merge pull request #17628 from ssahani/network-gso
udev: Add support to configure Generic Segment Offload
2021-01-13 05:42:23 +09:00
Karel Zak
4fcc033b54 udev-builtin-blkid: add support for --hint offsets
The next libblkid v2.37 is going to support session offsets for
multi-session CD/DVDs. This feature is implemented by "hint offsets".

These offsets are optional and prober specific (e.g., iso, udf, ...).
For this purpose, the library provides a new function
blkid_probe_set_hint(), and blkid(8) provides a new command-line
option --hint <name>=<offset>. For CD/DVD, the offset name is
"session_offset".

The difference between classic --offset and the new --hint is that
--offset is very restrictive and defines the probing area and the rest
of the device is invisible to the library. The new --hint works
like a suggestion, it provides a hint where the user assumes the
filesystem, but the rest of the device is still readable for the
library (for example, to get some additional superblock information
etc.).

If the --hint is without a value then it defaults to zero.

The option --hint implementation in udev-builtin-blkid.c is backwardly
compatible. If compiled against old libblkid, then the option is used in
the same way as --offset.

Addresses: https://github.com/karelzak/util-linux/issues/1161
Addresses: https://github.com/systemd/systemd/pull/17424
2021-01-13 00:58:43 +09:00
Susant Sahani
1e270127de link: Add support to configure Generic Segment Offload 2021-01-12 15:19:23 +01:00
Susant Sahani
ea07086285 network: Allow to configure VLan egress qos maps 2021-01-12 14:31:03 +01:00
Susant Sahani
0d9b8913e2 network: Allow to configure VLan egress qos maps 2021-01-12 14:30:56 +01:00
Yu Watanabe
1536b7b2d0 network: introduce new UseAddress= setting in [DHCPv6] section
If it is disabled, then the addresses provided by the DHCPv6 server will
be ignored.

Closes #18203.
2021-01-12 14:19:03 +09:00
Zbigniew Jędrzejewski-Szmek
a412ec5714 meson: fix git ls-files invocations during rebase
Normally ls-files prints the full path to files from the repo root. But when
$GIT_WORK_TREE is set, ls-files prints paths relative to the current
directory. When rebasing, $GIT_WORK_TREE is set in the commands executed from
'rebase -x'. This causes problems if meson config is touched and the meson
reconfigures itself. ($GIT_WORK_TREE shouldn't be relevant, since the paths that
ls-files reports don't depend on the work tree, but whatever.) Let's unset
GIT_WORK_TREE to avoid the issue.

$ (cd test; git --git-dir=$PWD/../.git ls-files ':/test/dmidecode-dumps/*.bin')
test/dmidecode-dumps/HP-Z600.bin
test/dmidecode-dumps/Lenovo-ThinkPad-X280.bin
test/dmidecode-dumps/Lenovo-Thinkcentre-m720s.bin

$ (cd test; GIT_WORK_TREE=$PWD/.. git --git-dir=$PWD/../.git ls-files ':/test/dmidecode-dumps/*.bin')
dmidecode-dumps/HP-Z600.bin
dmidecode-dumps/Lenovo-ThinkPad-X280.bin
dmidecode-dumps/Lenovo-Thinkcentre-m720s.bin

Fixes #18148.
2021-01-09 09:22:26 +09:00
Yu Watanabe
66bf4617b1
Merge pull request #18169 from OnkelUlla/can_bus_error_reporting
network: can: add support for bus error reporting
2021-01-09 09:21:54 +09:00
Ulrich Ölmann
77b674049b network: can: add support for bus error reporting
Enhance systemd-networkd to be able to control a CAN device's berr-reporting
flag via the new boolean directive BusErrorReporting= to be used in network
files.
2021-01-08 20:23:12 +01:00
Susant Sahani
007cac09a2 network: route - add support to configure tcp advmss 2021-01-08 14:06:13 +00:00
Susant Sahani
0a9fb9bad8 network: Allow to set device's receive queues and transmit queues 2021-01-05 12:46:28 +09:00
Yu Watanabe
ae45e1a383 resolve: slightly optimize dns_answer_add()
Previously, dns_answer_add() was O(n^2).
With this change dns_packet_extract() becomes ~15 times faster for some
extremal case.

Before:
```
$ time ./fuzz-dns-packet ~/downloads/clusterfuzz-testcase-minimized-fuzz-dns-packet-5631106733047808
/home/watanabe/downloads/clusterfuzz-testcase-minimized-fuzz-dns-packet-5631106733047808... ok

real    0m15.453s
user    0m15.430s
sys     0m0.007s
```

After:
```
$ time ./fuzz-dns-packet ~/downloads/clusterfuzz-testcase-minimized-fuzz-dns-packet-5631106733047808
/home/watanabe/downloads/clusterfuzz-testcase-minimized-fuzz-dns-packet-5631106733047808... ok

real    0m0.831s
user    0m0.824s
sys     0m0.006s
```

Hopefully fixes oss-fuzz#19227.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19227
2020-12-30 04:14:22 +09:00
Yu Watanabe
75d2641190 network: introduce RouterAllowList= and RouterDenyList= in [IPv6AcceptRA] 2020-12-24 17:16:15 +09:00
Susant Sahani
de6b6ff84c networkd: add support for prefix allow-list and route allow-list 2020-12-24 17:16:13 +09:00
Yu Watanabe
3f0af4a5f9 network: rename DenyList= -> PrefixDenyList= 2020-12-24 17:15:44 +09:00
Yu Watanabe
8786d4bbe4 journal-importer: ignore invalid field at one more place
Fixes oss-fuzz#28817.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28817
2020-12-21 12:40:44 +00:00
Devon Pringle
16c89e649d networkd: add RouteDenyList
Allow configuration for IPv6 discovered routes to be ignored instead of
adding them as a route. This can be used to block unwanted routes, for
example, you may wish to not receive some set of routes on an interface
if they are causing issues.
2020-12-18 21:44:32 +09:00
Susant Sahani
d7d1d18fd2
network: Allow to configure unreachable/blackhole RoutingPolicyRule (#17984) 2020-12-18 12:21:15 +09:00
Zbigniew Jędrzejewski-Szmek
199f75205b
Merge pull request #17799 from yuwata/oss-fuzz-25353
logs-show: skip non-utf8 name entries
2020-12-16 17:52:35 +01:00
Yu Watanabe
a7c52e1ee1
Merge pull request #17968 from yuwata/purge-libudev
udev: do not link with libudev
2020-12-16 12:07:46 +09:00
Susant Sahani
937e305e93 network: Allow to configure interface promiscuous mode 2020-12-15 20:25:08 +00:00
Yu Watanabe
f2bd032044 journal: refuse data which contain invalid fields
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25353.
2020-12-16 04:56:35 +09:00
Yu Watanabe
90ac73eb1b rules: drop broken links 2020-12-16 02:31:44 +09:00
walbit-de
2d453f3597
network: add Protocol= to vlan netdev (#17794) 2020-12-02 14:58:02 +01:00
Pavel Sapezhko
6d8325f66a resolved: allow cache responses from local DNS servers 2020-11-27 09:03:42 +09:00
Yu Watanabe
1763ef1d49 meson: do not build fuzzers when fuzz-tests=false
Closes #17578.
2020-11-13 18:15:37 +09:00
Lennart Poettering
394131d5be
Merge pull request #17497 from anitazha/randomizeonce
timer: add new feature FixedRandomDelay=
2020-11-10 13:29:04 +01:00
Yu Watanabe
db9ecf0501 license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 13:23:58 +09:00
Kristijan Gjoshev
acf24a1a84 timer: add new feature FixedRandomDelay=
FixedRandomDelay=yes will use
`siphash24(sd_id128_get_machine() || MANAGER_IS_SYSTEM(m) || getuid() || u->id)`,
where || is concatenation, instead of a random number to choose a value between
0 and RandomizedDelaySec= as the timer delay.
This essentially sets up a fixed, but seemingly random, offset for each timer
iteration rather than having a random offset recalculated each time it fires.

Closes #10355

Co-author: Anita Zhang <the.anitazha@gmail.com>
2020-11-05 10:59:33 -08:00
Yu Watanabe
9c914c0401
Merge pull request #17357 from yuwata/network-dhcp6-pd-announce-17353
network: add an option to control announcement of delegated prefix
2020-10-23 12:57:58 +09:00
Zbigniew Jędrzejewski-Szmek
515736d0f3 tree-wide: update web link to logind description
https://www.freedesktop.org/wiki/Software/systemd/multiseat/ says that it
is obsoleted by sd-login(3), so it doesn't make much sense to link to the former.
2020-10-19 15:23:37 +02:00
Yu Watanabe
99e1ab06b4 fuzz: move DNSDefaultRoute= setting to [Network] section 2020-10-19 14:55:21 +09:00
Yu Watanabe
27ff0490e6 network: rename IPv6PrefixDelegation= to IPv6SendRA= 2020-10-19 14:55:18 +09:00
Yu Watanabe
4afd986753 network: introduce Announce= in [DHCPv6PrefixDelegation]
When disabled, the delegated prefixes are not emit by RA.

Closes #17353.
2020-10-19 12:09:36 +09:00
Yu Watanabe
e502f94dcf network: introduce DHCPv6PrefixDelegation= setting
Then, the link can configure prefix delegated by DHCPv6 without emitting
RA.
2020-10-19 10:09:38 +09:00
Franck Bui
64a3494c3d udev: rename kernel option 'log_priority' into 'log_level'
Let's be consistent with the rest of the project.

'log_priority' is still supported for backward compatibility.
2020-09-22 09:05:57 +02:00
Yu Watanabe
1034044260
Merge pull request #15050 from ssahani/fq-pie
network: tc: add support for FQ-PIE packet scheduler
2020-09-18 03:50:02 +09:00
Yu Watanabe
dc0e90d2e0
Merge pull request #16929 from ssahani/network-bare-udp
network: introduce Bare UDP Tunnelling
2020-09-17 20:34:15 +09:00