summaryrefslogtreecommitdiff
path: root/src/resolve
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #6365 from keszybz/fast-testsMartin Pitt2017-07-283-3/+9
|\ | | | | Make tests faster by default
| * test-resolved-packet: skip most of the loopZbigniew Jędrzejewski-Szmek2017-07-133-3/+9
| | | | | | | | | | We want to test the edge cases, but testing all the values in between is mostly pointless and slow on slow architectures (>1s on rpi).
* | tree-wide: fput[cs]() → fput[cs]_unlocked() wherever that makes sense (#6396)Lennart Poettering2017-07-212-30/+30
| | | | | | | | | | | | | | | | As a follow-up for db3f45e2d2586d78f942a43e661415bc50716d11 let's do the same for all other cases where we create a FILE* with local scope and know that no other threads hence can have access to it. For most cases this shouldn't change much really, but this should speed dbus introspection and calender time formatting up a bit.
* | build-sys: drop gitignore patterns for in-tree buildsZbigniew Jędrzejewski-Szmek2017-07-181-6/+0
| | | | | | | | ... and other autotools-generated files.
* | build-sys: drop automake supportZbigniew Jędrzejewski-Szmek2017-07-181-1/+0
|/ | | | | v2: - also mention m4
* resolved: consider pointopoint links for local multicast (#6343)v234florianjacob2017-07-121-4/+1
| | | Resolves #6313.
* resolved: allow resolution of names which libidn2 considers invalid (#6315)Zbigniew Jędrzejewski-Szmek2017-07-112-3/+9
| | | | | | | https://tools.ietf.org/html/rfc5891#section-4.2.3.1 says that > The Unicode string MUST NOT contain "--" (two consecutive hyphens) in the third > and fourth character positions and MUST NOT start or end with a "-" (hyphen). This means that libidn2 refuses to encode such names. Let's just resolve them without trying to use IDN.
* Merge pull request #6289 from keszybz/config-tweaksDjalal Harouni2017-07-101-1/+1
|\ | | | | Config parsing tweaks
| * resolved: treat failure to parse config as non-fatalZbigniew Jędrzejewski-Szmek2017-07-051-1/+1
| | | | | | | | Fixes #6014.
* | resolve: Try to remove the ambiguity about the mtu parameter of ↵Benjamin Robin2017-07-053-10/+21
|/ | | | | | | | | | | | dns_packet_new (#6285) Actually the caller of dns_packet_new() pass 0 or the data size of the UDP message. So try to reflect that, so rename the `mtu` parameter to `min_alloc_dsize`. In fact `mtu` is the size of the whole UDP message, including the UDP header, and here we just need to pass the size of data (without header). This was confusing. Also add a check on the requested allocated size, since some caller do not check what is really allocated. Indeed the function do not allocate more than DNS_PACKET_SIZE_MAX whatever the value of the `mtu` parameter.
* resolved: downgrade log messages about switching DNS serversLennart Poettering2017-07-032-4/+4
| | | | | | | | | | As suggested in: https://github.com/systemd/systemd/commit/496ae8c84b2d3622bc767a727e3582e2b6bcffcd#commitcomment-22819483 Let's drop some noise from the logs, as switching between DNS servers is definitely useful for debugging, but shouldn't get more attention that that.
* Revert "resolved: drop unnecessary comparison (#6220)"Zbigniew Jędrzejewski-Szmek2017-06-281-1/+1
| | | | This reverts commit d718d20225bd631360ca5502b873278416616a03.
* resolved: drop unnecessary comparison (#6220)Zbigniew Jędrzejewski-Szmek2017-06-281-1/+1
| | | | mtu is always greater than UDP_PACKET_HEADER_SIZE at this point. Pointed out by Benjamin Robin.
* Merge pull request #6214 from keszybz/resolved-packet-sizeLennart Poettering2017-06-284-10/+66
|\ | | | | Resolved packet size
| * resolved: define various packet sizes as unsignedZbigniew Jędrzejewski-Szmek2017-06-272-4/+4
| | | | | | | | | | This seems like the right thing to do, and apparently at least some compilers warn about signed/unsigned comparisons with DNS_PACKET_SIZE_MAX.
| * resolved: do not allocate packets with minimum sizeZbigniew Jędrzejewski-Szmek2017-06-271-1/+11
| | | | | | | | | | | | | | | | | | dns_packet_new() is sometimes called with mtu == 0, and in that case we should allocate more than the absolute minimum (which is the dns packet header size), otherwise we have to resize immediately again after appending the first data to the packet. This partially reverts the previous commit.
| * resolved: simplify alloc size calculationZbigniew Jędrzejewski-Szmek2017-06-272-9/+1
| | | | | | | | | | | | | | | | | | The allocation size was calculated in a complicated way, and for values close to the page size we would actually allocate less than requested. Reported by Chris Coulson <chris.coulson@canonical.com>. CVE-2017-9445
| * test-resolved-packet: add a simple test for our allocation functionsZbigniew Jędrzejewski-Szmek2017-06-272-0/+54
| |
* | resolved: Recover from slow DNS responsesKai Krakow2017-06-271-1/+4
|/ | | | | | | | | | | | When DNS is unreliable temporarily, the current implementation will never improve resend behavior again and switch DNS servers only late (current maximum timeout is 5 seconds). We can improve this by biasing the resend_timeout back to the current RTT when a successful response was received. Next time, a timeout is hit on this server, it will switch to the next server faster. Fixes: #5953
* resolved: ignore DNSSEC= option when resolved is built without gcrypt (#6084)Yu Watanabe2017-06-172-0/+12
| | | Fixes #5583.
* resolved: bugfix of null pointer p->question dereferencing (#6020)Evgeny Vereshchagin2017-05-241-0/+3
| | | See https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1621396
* resolved: support libidn2 in addition to libidnZbigniew Jędrzejewski-Szmek2017-05-113-10/+32
| | | | | | | | | | | | | | | | | | | | | | | libidn2 2.0.0 supports IDNA2008, in contrast to libidn which supports IDNA2003. https://bugzilla.redhat.com/show_bug.cgi?id=1449145 From that bug report: Internationalized domain names exist for quite some time (IDNA2003), although the protocols describing them have evolved in an incompatible way (IDNA2008). These incompatibilities will prevent applications written for IDNA2003 to access certain problematic domain names defined with IDNA2008, e.g., faß.de is translated to domain xn--fa-hia.de with IDNA2008, while in IDNA2003 it is translated to fass.de domain. That not only causes incompatibility problems, but may be used as an attack vector to redirect users to different web sites. v2: - keep libidn support - require libidn2 >= 2.0.0 v3: - keep dns_name_apply_idna caller dumb, and keep the #ifdefs inside of the function. - use both ±IDN and ±IDN2 in the version string
* Mark python scripts executableZbigniew Jędrzejewski-Szmek2017-05-071-0/+0
| | | | | | | | | | Since all our python scripts have a proper python3 shebang, there is no benefit to letting meson autodetect them. On linux, meson will just uses exec(), so the shebang is used anyway. The only difference should be in how meson reports the script and that the detection won't fail for (most likely misconfigured) non-UTF8 locales. Closes #5855.
* Merge pull request #5842 from keszybz/meson-status-and-conditionalsMichael Biebl2017-05-031-1/+1
|\ | | | | Meson status and conditional simplification
| * meson: use booleans for conf.set and drop unecessary conditionalsZbigniew Jędrzejewski-Szmek2017-05-021-1/+1
| | | | | | | | | | | | | | | | | | Using conf.set() with a boolean argument does the right thing: either #ifdef or #undef. This means that conf.set can be used unconditionally. Previously I used '1' as the placeholder value, and that needs to be changed to 'true' for consistency (under meson 1 cannot be used in boolean context). All checks need to be adjusted.
* | more portable python shebangs (#5816)Jörg Thalheim2017-04-301-1/+1
|/ | | | | This is useful on systems like NixOS, where python3 is not in /usr/bin/python3 as well as for people using alternative ways to install python such as virtualenv/pyenv.
* build-sys: only install libexecdir/resolv.conf if resolved is enabled (#5826)userwithuid2017-04-271-3/+3
| | | as mentioned in https://github.com/systemd/systemd/pull/5811
* meson: also indent scripts with 8 spacesZbigniew Jędrzejewski-Szmek2017-04-251-5/+9
|
* meson: fix gcrypt config optionMichael Biebl2017-04-241-0/+3
| | | | | | | Also detect libgpg-error. Require both to be present for HAVE_CRYPT, even though libgpg-error is only used in src/resolve. If one is available, the other should be too, so it doesn't seem worth the trouble to make two separate conditions.
* meson: reindent all files with 8 spacesZbigniew Jędrzejewski-Szmek2017-04-231-149/+145
| | | | | | | The indentation for emacs'es meson-mode is added .dir-locals. All files are reindented automatically, using the lasest meson-mode from git. Indentation should now be fairly consistent.
* meson: eliminate libsystemd_journal_internal and use libsystemd_internal lessZbigniew Jędrzejewski-Szmek2017-04-231-5/+4
| | | | | | | | | This simplifies things and leads to a smaller installation footprint. libsystemd_internal and libsystemd_journal_internal are linked into libystemd-shared and available to all programs linked to libsystemd-shared. libsystemd_journal_internal is not needed anymore, and libsystemd-shared is used everwhere. The few exceptions are: libsystemd.so, test-engine, test-bus-error, and various loadable modules.
* meson: update linking for fixed meson linkingZbigniew Jędrzejewski-Szmek2017-04-231-1/+2
| | | | | | | | With mesonbuid/meson#1545, meson does not propagate deps of a library when linking with that library. That's of course the right thing to do, but it exposes a bunch of missing deps. This compiles with both meson-0.39.1 and meson-git + pr/1545.
* meson: define testsZbigniew Jędrzejewski-Szmek2017-04-231-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tests can be run with 'ninja-build test' or using 'mesontest'. '-Dtests=unsafe' can be used to include the "unsafe" tests in the test suite, same as with autotools. v2: - use more conf.get guards are optional components - declare deps on generated headers for test-{af,arphrd,cap}-list v3: - define environment for tests Most test don't need this, but to be consistent with autotools-based build, and to avoid questions which tests need it and which don't, set the same environment for all tests. v4: - rework test generation Use a list of lists to define each test. This way we can reduce the boilerplate somewhat, although the test listings are still pretty verbose. We can also move the definitions of the tests to the subdirs. Unfortunately some subdirs are included earlier than some of the libraries that test binaries are linked to. So just dump all definitions of all tests that cannot be defined earlier into src/test. The `executable` definitions are still at the top level, so the binaries are compiled into the build root. v5: - tag test-dnssec-complex as manual v6: - fix HAVE_LIBZ typo - add missing libgobject/libgio defs - mark test-qcow2 as manual
* meson: build systemd using mesonZbigniew Jędrzejewski-Szmek2017-04-234-0/+171
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's crucial that we can build systemd using VS2010! ... er, wait, no, that's not the official reason. We need to shed old systems by requring python 3! Oh, no, it's something else. Maybe we need to throw out 345 years of knowlege accumulated in autotools? Whatever, this new thing is cool and shiny, let's use it. This is not complete, I'm throwing it out here for your amusement and critique. - rules for sd-boot are missing. Those might be quite complicated. - rules for tests are missing too. Those are probably quite simple and repetitive, but there's lots of them. - it's likely that I didn't get all the conditions right, I only tested "full" compilation where most deps are provided and nothing is disabled. - busname.target and all .busname units are skipped on purpose. Otherwise, installation into $DESTDIR has the same list of files and the autoconf install, except for .la files. It'd be great if people had a careful look at all the library linking options. I added stuff until things compiled, and in the end there's much less linking then in the old system. But it seems that there's still a lot of unnecessary deps. meson has a `shared_module` statement, which sounds like something appropriate for our nss and pam modules. Unfortunately, I couldn't get it to work. For the nss modules, we need an .so version of '2', but `shared_module` disallows the version argument. For the pam module, it also didn't work, I forgot the reason. The handling of .m4 and .in and .m4.in files is rather awkward. It's likely that this could be simplified. If make support is ever dropped, I think it'd make sense to switch to a different templating system so that two different languages and not required, which would make everything simpler yet. v2: - use get_pkgconfig_variable - use sh not bash - use add_project_arguments v3: - drop required:true and fix progs/prog typo v4: - use find_library('bz2') - add TTY_GID definition - define __SANE_USERSPACE_TYPES__ - use join_paths(prefix, ...) is used on all paths to make them all absolute v5: - replace all declare_dependency's with [] - add more conf.get guards around optional components v6: - drop -pipe, -Wall which are the default in meson - use compiler.has_function() and compiler.has_header_symbol instead of the hand-rolled checks. - fix duplication in 'liblibsystemd' library name - use the right .sym file for pam_systemd - rename 'compiler' to 'cc': shorter, and more idiomatic. v7: - use ENABLE_ENVIRONMENT_D not HAVE_ENVIRONMENT_D - rename prefix to prefixdir, rootprefix to rootprefixdir ("prefix" is too common of a name and too easy to overwrite by mistake) - wrap more stuff with conf.get('ENABLE...') == 1 - use rootprefix=='/' and rootbindir as install_dir, to fix paths under split-usr==true. v8: - use .split() also for src/coredump. Now everything is consistent ;) - add rootlibdir option and use it on the libraries that require it v9: - indentation v10: - fix check for qrencode and libaudit v11: - unify handling of executable paths, provide options for all progs This makes the meson build behave slightly differently than the autoconf-based one, because we always first try to find the executable in the filesystem, and fall back to the default. I think different handling of loadkeys, setfont, and telinit was just a historical accident. In addition to checking in $PATH, also check /usr/sbin/, /sbin for programs. In Fedora $PATH includes /usr/sbin, (and /sbin is is a symlink to /usr/sbin), but in Debian, those directories are not included in the path. C.f. https://github.com/mesonbuild/meson/issues/1576. - call all the options 'xxx-path' for clarity. - sort man/rules/meson.build properly so it's stable
* Merge pull request #5756 from keszybz/make-cleanupsMartin Pitt2017-04-213-3/+3
|\ | | | | Various meson-independent cleanups from the meson patchset
| * bus: include sd-{bus,messages}.h the same as other systemd headersZbigniew Jędrzejewski-Szmek2017-04-213-3/+3
| | | | | | | | | | | | This is our own header, we should include use the local-include syntax ("" not <>), to make it clear we are including the one from the build tree. All other includes of files from src/systemd/ use this scheme.
* | tree-wide: fix wrong indent (#5757)Yu Watanabe2017-04-191-4/+4
|/ | | Fixes wrong indent introduced by the commit 43688c49d1fdb585196d94e2e30bb29755fa591b.
* resolved: add a DNSStubListener property to ManagerDavid Michael2017-03-311-0/+3
|
* resolved: detect and warn other running LLMNR stackYu Watanabe2017-03-211-59/+135
| | | | | | | | Previously, `SO_REUSEADDR` is set before `bind`-ing socket, Thus, even if another LLMNR stack is running, `bind` always success and we cannot detect the other stack. By this commit, we first try to `bind` without `SO_REUSEADDR`, and if it fails, show warning and retry with `SO_REUSEADDR`.
* resolved: add global config option to control mDNS stackYu Watanabe2017-03-212-0/+2
|
* resolved: detect and warn other running mDNS stackYu Watanabe2017-03-211-31/+71
| | | | | | | | Previously, `SO_REUSEADDR` is set before `bind`-ing socket, Thus, even if another mDNS stack (e.g. avahi) is running, `bind` always success and we cannot detect the other stack. By this commit, we first try to `bind` without `SO_REUSEADDR`, and if it fails, show warning and retry with `SO_REUSEADDR`.
* resolved: do not start LLMNR or mDNS stack when no network enables themYu Watanabe2017-03-212-8/+17
| | | | | | | When no network enables LLMNR or mDNS, it is not necessary to create LLMNR or mDNS related sockets. So, let's create them only when LLMNR- or mDNS-enabled network becomes active or at least one network enables `LLMNR=` or `MulticastDNS=` options.
* resolve: add missing space in output message (#5574)Yu Watanabe2017-03-121-2/+2
|
* resolved: add the new KSK to the built-in resolved trust anchor (#5486)Lennart Poettering2017-02-281-21/+51
| | | Fixes: #5482
* Fix missing space in comments (#5439)AsciiWolf2017-02-244-6/+6
|
* tree-wide: add man: to manpage references (#5402)Lucas Werkmeister2017-02-201-3/+3
| | | | | Found with: git grep '"[^"]*[a-z0-9]([0-9]\+p\?)' src/ | grep -vF man:
* Merge pull request #5347 from poettering/local-ntaZbigniew Jędrzejewski-Szmek2017-02-1710-70/+235
|\ | | | | more resolved fixes
| * resolved: try to authenticate SOA on negative repliesLennart Poettering2017-02-171-2/+12
| | | | | | | | | | | | For caching negative replies we need the SOA TTL information. Hence, let's authenticate all auxiliary SOA RRs through DS requests on all negative requests.
| * resolved: extend various timeoutsLennart Poettering2017-02-174-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's increase a number of timeouts as they apparently are too short for some real-world lookups. See: https://github.com/systemd/systemd/issues/4003#issuecomment-279842616 In particular we change the following timeouts: 1) The first UDP retry we increase 500ms → 750ms. This is a good idea, since some servers need relatively long responses for trivial lookups, and giving up our first attempt also has the effect of trying a different server for the next attempt which has the side effect that we'll run two down-grade iterations in parallel, on both servers. Hence, let's give servers a bit more time in the first iteration. 2) Permit 24 retries instead of just 16 per transactions. If we end up downgrading all the way down to UDP for a lookup we already need 5 iterations for that. If we want permit a couple of lost packages for each (let's say 4), then we already need 20 iterations. 3) Increase the overall query timeout on the service side to 60s (from 45s), simply because very long and slow DNSSEC + CNAME chains (such as us.ynuf.alipay.com) hit this boundary too easily. The client side timeout for the bus method call is increased to 90s, in order to have room for the dbus reply to go through
| * resolved: initialize all return values on successful exit of dns_cache_lookup()Lennart Poettering2017-02-171-0/+4
| | | | | | | | | | | | Following our coding style on success we should initialize all return parameters of a function. We missed to cases for dns_cache_lookup() (but covered all others), fix them too.
View Lorry Controller Status