| Age | Commit message (Collapse) | Author |
|---|
|
Also downgrade non-fatal warnings to log_warning.
Previously rule_add_key() would check the output array and log a cryptic
error and return -1. Most of the time the return value was ignored. This
does not seems right, because the buffer can overflow with enough rules.
It would also check if we have enough space for the *next* rule, even if
there might be not next rule, i.e. off-by-one.
Replace this with a check that we have enough space for a next rule before
we start parsing.
Normally using macros to alter flow is not allowed, but in this case I
think it is worth it, because it allows lots of boilerplate code to be
removed and hides repeated boring parameters, making function logic much
easier to follow.
|
|
If the attribute wasn't found, the last filename looked at was returned in
the input/output argument. This just seems bad style.
The return value was ignored, so change function to return void.
|
|
|
|
CID #1313566.
Also, change the return value to void, because it is ignored anyway.
|
|
set_iterate sets the output argument to NULL on error, and the return
value is not used in this case.
CID #1306804-09.
|
|
CID #1320855.
|
|
coverity seems to think that our siphash code can read past the
end of a short buffer. Add a test which adds very short buffers
with different combinations of length to the hash. Hashing is done
twice, once with zeros following "data", and once with some other
bytes following "data". The two results are then compared to
verify that the result does not depend on bytes past the specified
data length.
(This test passes.)
|
|
|
|
Coverity fixes
|
|
Running "udevadm test-builtin path_id /sys/devices/platform/" results
in a segmentation fault.
The problem is that udev_device_get_subsystem(dev) might return NULL
in a streq() call. Solve this problem by using streq_ptr() instead.
|
|
This is a cosmetic best-effort thing anyway.
|
|
CID #1351544, #1351545.
|
|
Include and internal struct member fixes.
|
|
Memleaks and ubsan
|
|
activate: fix -E option parsing
|
|
Better support for DANE, shell completion
|
|
Fixes #2658.
|
|
gcc thinks that multiplier might be unitialized. Split out the inner
loop to make the function easier to grok.
|
|
The test was failing at -O2+ with gcc 5.3 and 6.0.
"val1" == "val1" and "val1" != "val1" are both valid.
http://stackoverflow.com/questions/4843640/why-is-a-a-in-c
|
|
Various buffers were lost because finish_item() either consumed
the buffer or allocated a new one (if an entry with the same key existed).
The caller would simply forget the buffer in either case.
Also add a check for the case when a valid identifier is followed by
an empty body. We should not allow this.
Also be more consistent in error handling and always print an error
message.
|
|
Das ist verboten!
src/basic/strbuf.c:162:23: runtime error: null pointer passed as argument 2,
which is declared to never be null
|
|
|
|
|
|
alloc-util: extract overflow check into inline function
|
|
This patch contains a set of little cleanups for alloc-util.h:
1. The malloc_multiply(), realloc_multiply() and memdup_multiply()
functions check allocation related parameters on overflow. Let's
move them to the separate size_multiply_overflow() function for
simplicity, code duplication prevention and possible reuse in future.
2. use SIZE_MAX from stdlib instead of ((size_t) - 1) to be more
clear.
3. The 'a'/'b' variables are renamed to 'size' and 'need' to be
more clear.'
|
|
|
|
https://tools.ietf.org/html/rfc6698#section-2.2 says:
> The certificate association data field MUST be represented as a string
> of hexadecimal characters. Whitespace is allowed within the string of
> hexadecimal characters
|
|
$ systemd-resolve --tlsa fedoraproject.org
_443._tcp.fedoraproject.org IN TLSA 0 0 1 GUAL5bejH7czkXcAeJ0vCiRxwMnVBsDlBMBsFtfLF8A=
-- Cert. usage: CA constraint
-- Selector: Full Certificate
-- Matching type: SHA-256
$ systemd-resolve --tlsa=tcp fedoraproject.org:443
_443._tcp.fedoraproject.org IN TLSA 0 0 1 GUAL5bejH7czkXcAeJ0vCiRxwMnVBsDlBMBsFtfLF8A=
...
$ systemd-resolve --tlsa=udp fedoraproject.org
_443._udp.fedoraproject.org: resolve call failed: '_443._udp.fedoraproject.org' not found
v2:
- use uint16_t
- refuse port 0
|
|
This reverts commit cb48dfca6a8bc15d9081651001a16bf51e03838a.
Exec*-settings resolve specifiers twice:
%%U -> config_parse_exec [cb48dfca6a8] -> %U -> service_spawn -> 0
Fixes #2637
|
|
+ perl -e 'exit(!(qq{0} eq qq{\x25U}))'
exec-spec-interpolation.service: Main process exited, code=exited, status=1/FAILURE
exec-spec-interpolation.service: Unit entered failed state.
exec-spec-interpolation.service: Failed with result 'exit-code'.
PID: 11270
Start Timestamp: Wed 2016-02-17 22:21:31 UTC
Exit Timestamp: Wed 2016-02-17 22:21:31 UTC
Exit Code: exited
Exit Status: 1
Assertion 'service->main_exec_status.status == status_expected' failed at src/test/test-execute.c:65, function check(). Aborting.
|
|
resolve: dumping of binary packets
|
|
DNS_TYPE_STRING_MAX causes a problem with the table autogeneration code,
change to _DNS_TYPE_STRING_MAX.
|
|
When the buffer is allocated on the stack we do not have to check for
failure everywhere. This is especially useful in debug statements, because
we can put dns_resource_key_to_string() call in the debug statement, and
we do not need a seperate if (log_level >= LOG_DEBUG) for the conversion.
dns_resource_key_to_string() is changed not to provide any whitespace
padding. Most callers were stripping the whitespace with strstrip(),
and it did not look to well anyway. systemd-resolve output is not column
aligned anymore.
The result of the conversion is not stored in DnsTransaction object
anymore. It is used only for debugging, so it seems fine to generate it
when needed.
Various debug statements are extended to provide more information.
|
|
This fixes formatting of root domain in debug messages:
Old:
systemd-resolved[10049]: Requesting DS to validate transaction 19313 (., DNSKEY with key tag: 19036).
New:
systemd-resolved[10049]: Requesting DS to validate transaction 19313 (, DNSKEY with key tag: 19036).
|
|
With two nested loops and a switch statements, it's quite hard to
understand what break and continue mean.
|
|
|
|
$ systemd-resolve --raw --openpgp zbyszek@fedoraproject.org | pgpdump /dev/stdin
|
|
The output didn't specify if the default for --cname/--search/--legend and
other options was yes or no. Change the description to be explicit about that.
Also make the --help output and man page closer.
|
|
Networkd, resolved, build-sys fixes
|
|
networkd: FIONREAD is not reliable on some sockets
|
|
main: no need to set errno manually
|
|
Most domain names we deal with are normalized anyway (since we read them that
way from DNS packets), but some might not (because they are synthesized from
unnormalized configuration or so), hence make sure to normalize all names
before passing them out to clients, to be fully deterministic.
Note that internally we are process normalized and non-normalized names the
same way, and while comparing them ignore the differences due to unnormalized
names. However, that internal implementation detail really shouldn't spill out
the clients, hence make sure to clean it all up.
|
|
Fixes fall-out from 8b3aa503c171acdb9ec63484a8c50e2680d31e79.
Fixes: #2635
|
|
Fixes: #2632
|
|
authenticated
Doing DNS retrieval on non-authenticated crypt keys is useless, hence warn
loudly about it.
|
|
This patch makes networkd stay around as long as there is more than just a
loopback interface around, or the loopback device isn't fully probed yet, or
the loopback device has a .network file attached.
In essence, this means networkd stays around now continously as it should,
unless it is running in some (container?) environment that really has no
interface except a loopback device.
Fixes #2577.
|
|
Before this patch existence of char16_t, char32_t, key_serial_t was checked
with AC_CHECK_DECLS() which doesn't actually work for types. Correct this to
use AC_CHECK_TYPES() instead.
Also, while we are at it, change the check for memfd_create() to use
AC_CHECK_DECLS() instead of AC_CHECK_FUNCS(). This is a better choice, since a
couple of syscalls are defined by glibc but not exported in the header files
(pivot_root() for example), and we hence should probably be more picky with
memfd_create() too, which glibc might decide to expose one day, but not
necessarily in the headers too.
|
|
Let's make sure DNSSEC gets more testing, by defaulting DNSSEC to
"allow-downgrade" mode. Since distros should probably not ship DNSSEC enabled
by default add a configure switch to disable this again.
DNSSEC in "allow-downgrade" mode should mostly work without affecting user
experience. There's one exception: some captive portal systems rewrite DNS in
order to redirect HTTP traffic to the captive portal. If these systems
implement DNS servers that are otherwise DNSSEC-capable (which in fact is
pretty unlikely, but still...), then this will result in the captive portal
being inaccessible. To fix this support in NetworkManager (or any other network
management solution that does captive portal detection) is required, which
simply turns off DNSSEC during the captive portal detection, and resets it back
to the default (i.e. on) after captive portal authentication is complete.
|
|
If we are not PID 1 and started as init, we executing systemctl
with execv(). Here no need to set errno manually, because in a
failure case, because the execv() anyway will set errno depends
on a error.
|
|
systemctl: fix style to avoid modification of array passed by caller
|
