summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-01-18update DNSSEC TODOLennart Poettering
2016-01-18resolved: don't try to print error strings, where errno isn't setLennart Poettering
2016-01-18resolved: when restarting a transaction pick a new IDLennart Poettering
When we restart a transaction because of an incompatible server, pick a new transaction ID. This should increase compatibility with DNS servers that don't like if they get different requests with the same transaction ID.
2016-01-18resolved: enforce maximum limit on DNS transactionsLennart Poettering
given that DNSSEC lookups may result in quite a number of auxiliary transactions, let's better be safe than sorry and also enforce a limit on the number of total transactions, not just on the number of queries.
2016-01-18resolved: add DNAME test case to the complex DNSSEC testLennart Poettering
2016-01-18resolved: fix how we detect whether auxiliary DNSSEC transactions are readyLennart Poettering
Previously, when getting notified about a completed auxiliary DNSSEC transaction we'd immediately act on it, and possibly abort the main transaction. This is problematic, as DNS transactions that already completed at the time we started using them will never get the notification event, and hence never be acted on in the same way. Hence, introduce a new call dns_transaction_dnssec_ready() that checks the state of auxiliary DNSSEC transactions, and returns 1 when we are ready for the actual DNSSEC validation step. Then, make sure this is invoked when the auxiliary transactions are first acquired (and thus possibly reused) as well when the notifications explained above take place. This fixes problems particularly when doing combined A and AAAA lookups where the auxiliary DNSSEC transactions get reused between them, and where we got confused if we reused an auxiliary DNSSEC transaction from one when it already got completed from the other.
2016-01-18resolved: end log messages in a full stopLennart Poettering
2016-01-18resolved: never consider following a CNAME/DNAME chain for a CNAME/DNAME lookupLennart Poettering
Let's avoid thinking that a CNAME/DNAME chain traversal could be a good idea if QTYPE is already CNAME/DNAME. (Also, let's bail out early when trying to see if some RR is a suitable CNAME/DNAME for some other RR).
2016-01-18resolved: when following a CNAME, turn off search domainsLennart Poettering
If the first step was done via a search domain, make sure the subsequent steps are not.
2016-01-18resolved: properly reset old collected data when following a CNAME redirectLennart Poettering
2016-01-18resolved: beef up complex dnssec test to also use ResolveAddress() and do ↵Lennart Poettering
IDNA checks
2016-01-18resolved: rework IDNA logicLennart Poettering
Move IDNA logic out of the normal domain name processing, and into the bus frontend calls. Previously whenever comparing two domain names we'd implicitly do IDNA conversion so that "pöttering.de" and "xn--pttering-n4a.de" would be considered equal. This is problematic not only for DNSSEC, but actually also against he IDNA specs. Moreover it creates problems when encoding DNS-SD services in classic DNS. There, the specification suggests using UTF8 encoding for the actual service name, but apply IDNA encoding to the domain suffix. With this change IDNA conversion is done only: - When the user passes a non-ASCII hostname when resolving a host name using ResolveHostname() - When the user passes a non-ASCII domain suffix when resolving a service using ResolveService() No IDNA encoding is done anymore: - When the user does raw ResolveRecord() RR resolving - On the service part of a DNS-SD service name Previously, IDNA encoding was done when serializing names into packets, at a point where information whether something is a label that needs IDNA encoding or not was not available, but at a point whether it was known whether to generate a classic DNS packet (where IDNA applies), or an mDNS/LLMNR packet (where IDNA does not apply, and UTF8 is used instead for all host names). With this change each DnsQuery object will now maintain two copies of the DnsQuestion to ask: one encoded in IDNA for use with classic DNS, and one encoded in UTF8 for use with LLMNR and MulticastDNS.
2016-01-18resolved: minor optimization for dns_question_is_equal()Lennart Poettering
If the poinetrs are equal, we don't have to do a deep comparison. This is similar to a similar optimization we already have in place for RRs and keys.
2016-01-18resolved: be slightly stricter when validating DnsQuestionLennart Poettering
Also verify whether the DNS RR types are actually suitable for a question.
2016-01-18resolved: make key argument of dns_question_contains() constLennart Poettering
2016-01-18resolved add dns_name_apply_idna() to convert a domain name into its IDNA ↵Lennart Poettering
equivalent
2016-01-18Merge pull request #2326 from poettering/dnssec15Tom Gundersen
Fifteenth batch of DNSSEC patches
2016-01-18Merge pull request #2352 from martinpitt/masterDaniel Mack
keymap: Add HP ProBook 440 G3
2016-01-18keymap: Add HP ProBook 440 G3Martin Pitt
Fixes #2343
2016-01-18Merge pull request #2347 from aroig/gh/fix-udev-user-wantsDaniel Mack
Fix broken SYSTEMD_USER_WANTS in udev rules.
2016-01-18Merge pull request #2350 from evverx/fix-memory-leak-on-failed-preset-allDaniel Mack
core: fix memory leak on failed preset-all
2016-01-18Merge pull request #2349 from evverx/test-functions-cleanupDaniel Mack
tests: various fixes
2016-01-18tests: add STRIP_BINARIESEvgeny Vereshchagin
We need a beautiful stacktraces sometimes For example https://github.com/systemd/systemd/pull/2328
2016-01-18core: fix memory leak on failed preset-allEvgeny Vereshchagin
How to reproduce $ systemctl set-default multi-user # https://github.com/systemd/systemd/issues/2298 $ systemctl preset-all Failed to execute operation: Too many levels of symbolic links $ systemctl poweroff Fixes: ==1== ==1== HEAP SUMMARY: ==1== in use at exit: 65,645 bytes in 7 blocks ==1== total heap usage: 40,539 allocs, 40,532 frees, 30,147,547 bytes allocated ==1== ==1== 109 (24 direct, 85 indirect) bytes in 1 blocks are definitely lost in loss record 2 of 7 ==1== at 0x4C2BBCF: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==1== by 0x4C2DE2F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==1== by 0x23DA71: unit_file_changes_add (install.c:233) ==1== by 0x23E45D: remove_marked_symlinks_fd (install.c:453) ==1== by 0x23E267: remove_marked_symlinks_fd (install.c:405) ==1== by 0x23E641: remove_marked_symlinks (install.c:494) ==1== by 0x243A91: execute_preset (install.c:2190) ==1== by 0x244343: unit_file_preset_all (install.c:2351) ==1== by 0x18AAA2: method_preset_all_unit_files (dbus-manager.c:1846) ==1== by 0x1D8157: method_callbacks_run (bus-objects.c:420) ==1== by 0x1DA9E9: object_find_and_run (bus-objects.c:1257) ==1== by 0x1DB02B: bus_process_object (bus-objects.c:1373) ==1== ==1== LEAK SUMMARY: ==1== definitely lost: 24 bytes in 1 blocks ==1== indirectly lost: 85 bytes in 1 blocks ==1== possibly lost: 0 bytes in 0 blocks ==1== still reachable: 65,536 bytes in 5 blocks ==1== suppressed: 0 bytes in 0 blocks ==1== Reachable blocks (those to which a pointer was found) are not shown. ==1== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==1== ==1== For counts of detected and suppressed errors, rerun with: -v ==1== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
2016-01-18tests: fix TEST-03-JOBSEvgeny Vereshchagin
We have JOB UNIT TYPE STATE 1 testsuite.target start waiting 81 end.service start waiting 187 sleep.service start waiting 136 hello.service start waiting 82 testsuite.service start running 135 hello-after-sleep.target start waiting sometimes
2016-01-18tests: remove unnecessary setup_nspawn_rootEvgeny Vereshchagin
we don't run nspawn in TEST-02-CRYPTSETUP
2016-01-18tests: fix TEST-02-CRYPTSETUP on Debian/UbuntuEvgeny Vereshchagin
2016-01-18tests: install fsck*Evgeny Vereshchagin
systemd-fsck depends on /sbin/fsck*
2016-01-18tests: remove unnecessary --bootEvgeny Vereshchagin
* Use $ROOTLIBDIR/systemd always * Don't pass $ROOTLIBDIR/systemd as the first argument: $ cat /proc/1/cmdline /lib/systemd/systemd/lib/systemd/systemd...
2016-01-17resolved: fix logging about DNAME redirectionLennart Poettering
2016-01-17resolved: when we find a DNAME RR, don't insist in a signed CNAME RRLennart Poettering
If we have a signed DNAME RR response, there's no need to insist on a signature for a CNAME RR response, after all it is unlikely to be signed, given the implicit synthethis of CNAME through DNAME RRs.
2016-01-17Fix broken SYSTEMD_USER_WANTS in udev rules.Abdo Roig-Maranges
The functionality of SYSTEMD_USER_WANTS that attaches dependencies to device units from udev rules was broken since commit b2c23da8. I guess it was due to a mass replace s/SYSTEMD_USER/MANAGER_USER/.
2016-01-17units: don't fail if /root doesn't exist for shell unitsLennart Poettering
As discussed on the ML: http://lists.freedesktop.org/archives/systemd-devel/2016-January/035594.html
2016-01-17resolved: update DNSSEC TODOLennart Poettering
2016-01-17resolved: try to reduce number or DnsResourceKeys we keep around by merging themLennart Poettering
Quite often we read the same RR key multiple times from the same message. Try to replace them by a single object when we notice this. Do so again when we add things to the cache. This should reduce memory consumption a tiny bit.
2016-01-17resolved: when switching between DNSSEC modes, possibly flush cachesLennart Poettering
If the networkd configuration changes during runtime, make sure to flush all caches when we switch from a less trusted to a more trusted mode.
2016-01-17resolved: when the server feature level changes between query and response ↵Lennart Poettering
restart transaction In some cases we learn something about a server's feature level through its responses. If we notice that after doing basic checking of a response, and after collecting all auxiliary DNSSEC info the feature level of the server is lower than where we started, restart the whole transaction. This is useful to deal with servers that response rubbish when talked to with too high feature levels.
2016-01-17resolved: check OPT RR before accepting a reply for verification of server ↵Lennart Poettering
feature level Let's make sure we first check if the OPT was lost in the reply, before we accept a reply as successful and use it for verifying the current feature level.
2016-01-17resolved: when restarting a DNS transaction, remove all auxiliary DNSSEC ↵Lennart Poettering
transactions When we restart a DNS transaction, remove all connections to any auxiliary DNSSEC transactions, after all we might acquire completely different data this time, requiring different auxiliary DNSSEC transactions.
2016-01-17resolved: when we receive an reply which is OPT-less or RRSIG-less, ↵Lennart Poettering
downgrade what we verified If we receive a reply that lacks the OPT RR, then this is reason to downgrade what was verified before, as it's apparently no longer true, and the previous OPT RR we saw was only superficially OK. Similar, if we realize that RRSIGs are not augmented, then also downgrade the feature level that was verified, as DNSSEC is after all not supported. This check is in particular necessary, as we might notice the fact that RRSIG is not augmented only very late, when verifying the root domain. Also, when verifying a successful response, actually take in consideration that it might have been reported already that RRSIG or OPT are missing in the response.
2016-01-17resolved: downgrade server feature level more aggressively when we have ↵Lennart Poettering
reason to This adds logic to downgrade the feature level more aggressively when we have reason to. Specifically: - When we get a response packet that lacks an OPT RR for a query that had it. If so, downgrade immediately to UDP mode, i.e. don't generate EDNS0 packets anymore. - When we get a response which we are sure should be signed, but lacks RRSIG RRs, we downgrade to EDNS0 mode, i.e. below DO mode, since DO is apparently not really supported. This should increase compatibility with servers that generate non-sensical responses if they messages with OPT RRs and suchlike, for example the situation described here: https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html This also changes the downgrade code to explain in a debug log message why a specific downgrade happened.
2016-01-17resolved: ignore invalid OPT RRs in incoming packetsLennart Poettering
This validates OPT RRs more rigorously, before honouring them: if we any of the following condition holds, we'll ignore them: a) Multiple OPT RRs in the same message b) OPT RR not owned by the root domain c) OPT RR in the wrong section (Belkin routers do this) d) OPT RR contain rfc6975 algorithm data (Belkin routers do this) e) OPT version is not 0 f) OPT payload doesn't add up with the lengths Note that d) may be an indication that the server just blindly copied OPT data from the response into the reply. RFC6975 data is only supposed to be included in queries, and we do so. It's not supposed to be included in responses (and the RFC is very clear on that). Hence if we get it back in a reply, then the server probably just copied the OPT RR.
2016-01-17resolved: update RFCs list and TODO listLennart Poettering
2016-01-17resolved: add complex test caseLennart Poettering
This new test case tries to resolve a couple of known domains, to verify the validation results. It talks to resolved via the bus, thus comprehensively testing the whole shebang. Of course, it requires network connectivity and a DNSSEC capable DNS server, hence this is a manual test.
2016-01-17resolved: complete NSEC non-existance proofsLennart Poettering
This fills in the last few gaps: - When checking if a domain is non-existing, also check that no wildcard for it exists - Ensure we don't base "covering" tests on NSEC RRs from a parent zone - Refuse to accept expanded wildcard NSEC RRs for absence proofs.
2016-01-17resolved: make sure the NSEC proof-of-non-existance check also looks for ↵Lennart Poettering
wildcard domains
2016-01-17resolved: on negative NODATA replies, properly deal with empty non-terminalsLennart Poettering
empty non-terminals generally lack NSEC RRs, which means we can deduce their existance only from the fact that there are other RRs that contain them in their suffix. Specifically, the NSEC proof for NODATA on ENTs works by sending the NSEC whose next name is a suffix of the queried name to the client. Use this information properly.
2016-01-17resolved: rename dnssec_verify_dnskey() → dnssec_verify_dnskey_by_ds()Lennart Poettering
This should clarify that this is not regular signature-based validation, but validation through DS RR fingerprints.
2016-01-17resolved: be stricter when using NSEC3Lennart Poettering
We can user signer and synthesizing source information to check that the NSEC3 RRs we want to use are actually reasonable and properly signed.
2016-01-17resolved: when validating an RRset, store information about the synthesizing ↵Lennart Poettering
source and zone in each RR Having this information available is useful when we need to check whether various RRs are suitable for proofs. This information is stored in the RRs as number of labels to skip from the beginning of the owner name to reach the synthesizing source/signer. Simple accessor calls are then added to retrieve the signer/source from the RR using this information. This also moves validation of a a number of RRSIG parameters into a new call dnssec_rrsig_prepare() that as side-effect initializes the two numeric values.