summaryrefslogtreecommitdiff
path: root/src/core/socket.c
Commit message (Collapse)AuthorAge
* socket: introduce SELinuxContextFromNet optionMichal Sekletar2014-09-19
| | | | | | | | | | This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_mls_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
* exec: factor out most function arguments of exec_spawn() to ExecParametersDaniel Mack2014-09-05
| | | | | | | | | | This way, the list of arguments to that function gets more comprehensive, and we can get around passing lots of NULL and 0 arguments from socket.c, swap.c and mount.c. It also allows for splitting up the code in exec_spawn(). While at it, make ExecContext const in execute.c.
* core: unify how we generate the prefix string when dumping unit stateLennart Poettering2014-08-21
|
* socket: suffix newly added TCP sockopt time properties with "Sec"Lennart Poettering2014-08-19
| | | | | | This is what we have done so far for all other time values, and hence we should do this here. This indicates the default unit of time values specified here, if they don't contain a unit.
* Revert "socket: introduce SELinuxLabelViaNet option"Lennart Poettering2014-08-19
| | | | | | This reverts commit cf8bd44339b00330fdbc91041d6731ba8aba9fec. Needs more discussion on the mailing list.
* socket: introduce SELinuxLabelViaNet optionMichal Sekletar2014-08-19
| | | | | | | | | | This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
* socket: Add support for TCP defer acceptSusant Sahani2014-08-14
| | | | | | | | | | | TCP_DEFER_ACCEPT Allow a listener to be awakened only when data arrives on the socket. If TCP_DEFER_ACCEPT set on a server-side listening socket, the TCP/IP stack will not to wait for the final ACK packet and not to initiate the process until the first packet of real data has arrived. After sending the SYN/ACK, the server will then wait for a data packet from a client. Now, only three packets will be sent over the network, and the connection establishment delay will be significantly reduced.
* socket: Add Support for TCP keep alive variablesSusant Sahani2014-08-14
| | | | | | | | | | | | | | The tcp keep alive variables now can be configured via conf parameter. Follwing variables are now supported by this patch. tcp_keepalive_intvl: The number of seconds between TCP keep-alive probes tcp_keepalive_probes: The maximum number of TCP keep-alive probes to send before giving up and killing the connection if no response is obtained from the other end. tcp_keepalive_time: The number of seconds a connection needs to be idle before TCP begins sending out keep-alive probes.
* Revert "socket: add support for TCP fast Open"Lennart Poettering2014-08-14
| | | | | | | | This reverts commit 9528592ff8d7ff361da430285deba8196e8984d5. Apparently TFO is actually the default at least for the server side now. Also the setsockopt doesn't actually take a bool, but a qlen integer.
* socket: add support for TCP fast OpenSusant Sahani2014-08-14
| | | | | | | | | | TCP Fast Open (TFO) speeds up the opening of successiveTCP) connections between two endpoints.It works by using a TFO cookie in the initial SYN packet to authenticate a previously connected client. It starts sending data to the client before the receipt of the final ACK packet of the three way handshake is received, skipping a round trip and lowering the latency in the start of transmission of data.
* socket: add support for tcp nagleSusant Sahani2014-08-14
| | | | | | | This patch adds support for TCP TCP_NODELAY socket option. This can be configured via NoDelay conf parameter. TCP Nagle's algorithm works by combining a number of small outgoing messages, and sending them all at once. This controls the TCP_NODELAY socket option.
* systemd-verify: a simple tool for offline unit verificationZbigniew Jędrzejewski-Szmek2014-07-20
| | | | | | | | This tool will warn about misspelt directives, unknown sections, and non-executable commands. It will also catch the common mistake of using Accept=yes with a non-template unit and vice versa. https://bugs.freedesktop.org/show_bug.cgi?id=56607
* socket: check return from exec_spawnThomas Hindoe Paaboel Andersen2014-06-18
|
* Remove sysv parser from service.cThomas Hindoe Paaboel Andersen2014-06-07
| | | | | | | | | | | Parsing sysv files was moved to the sysv-generator in the previous commit. This patch removes the sysv parsing from serivce.c. Note that this patch drops the following now unused sysv-specific info from service dump: "SysV Init Script has LSB Header: (yes/no)" "SysVEnabled: (yes/no)" "SysVRunLevels: (levels)"
* fix warningsThomas Hindoe Paaboel Andersen2014-06-06
| | | | | Prevent use of uninitialized variable and removed a now unused cleanup function for freeaddrinfo
* kdbus: when uploading bus name policy, resolve users/groups out-of-processLennart Poettering2014-06-05
| | | | | It's not safe invoking NSS from PID 1, hence fork off worker processes that upload the policy into the kernel for busnames.
* socket: add SocketUser= and SocketGroup= for chown()ing sockets in the file ↵Lennart Poettering2014-06-05
| | | | | | | system This is relatively complex, as we cannot invoke NSS from PID 1, and thus need to fork a helper process temporarily.
* socket: add new Symlinks= option for socket unitsLennart Poettering2014-06-04
| | | | | | | | | | | With Symlinks= we can manage one or more symlinks to AF_UNIX or FIFO nodes in the file system, with the same lifecycle as the socket itself. This has two benefits: first, this allows us to remove /dev/log and /dev/initctl from /dev, thus leaving only symlinks, device nodes and directories in the /dev tree. More importantly however, this allows us to move /dev/log out of /dev, while still making it accessible there, so that PrivateDevices= can provide /dev/log too.
* socket: optionally remove sockets/FIFOs in the file system after useLennart Poettering2014-06-04
|
* build-sys: use glibc's xattr support instead of requiring libattrKay Sievers2014-05-28
|
* socket: properly handle if our service vanished during runtimeLennart Poettering2014-05-22
|
* Remove unnecessary casts in printfsZbigniew Jędrzejewski-Szmek2014-05-15
| | | | No functional change expected :)
* Handle Unix domain socket connections from outside our namespace v2Zbigniew Jędrzejewski-Szmek2014-04-19
| | | | | This is a second attempt at 9754d56, reverted in 2f20a8e, because I lost a 'break;' when moving chunks around.
* Revert "Handle Unix domain socket connections from outside our namespace"Kay Sievers2014-04-19
| | | | | | | | | | This reverts commit 9754d56e9b21bfe89fc18f47987d6bef491b8521. It causes a crash in PID1: Apr 19 13:49:32 lon systemd[1]: Code should not be reached 'Unhandled socket type.' at src/core/socket.c:684, function instance_from_socket(). Aborting. Apr 19 13:49:32 lon systemd[1]: Caught <ABRT>, dumped core as pid 336. Apr 19 13:49:32 lon systemd[1]: Freezing execution.
* Handle Unix domain socket connections from outside our namespaceEelco Dolstra2014-04-16
| | | | | | | | | | | | | | | | | | NixOS uses Unix domain sockets for certain host <-> container interaction; i.e. the host connects to a socket visible in the container's directory tree, where the container uses a .socket unit to spawn the handler program on demand. This worked in systemd 203, but in 212 fails with "foo.socket failed to queue service startup job (Maybe the service file is missing or not a template unit?): No data available". The reason is that getpeercred() now returns ENODATA if it can't get the PID of the client, which happens in this case because the client is not in the same PID namespace. Since getpeercred() is only used to generate the instance name, this patch simply handles ENODATA by creating an instance name "<nr>-unknown". [zj: reorder clauses and remove (unsigned long) casts.]
* sd-event: rework API to support CLOCK_REALTIME_ALARM and ↵Lennart Poettering2014-03-24
| | | | CLOCK_BOOTTIME_ALARM, too
* core: rework context initialization/destruction logicLennart Poettering2014-03-19
| | | | | | | | Let's automatically initialize the kill, exec and cgroup contexts of the various unit types when the object is constructed, instead of invididually in type-specific code. Also, when PrivateDevices= is set, set DevicePolicy= to closed.
* util: replace close_nointr_nofail() by a more useful safe_close()Lennart Poettering2014-03-18
| | | | | | | | | | | | | | | safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
* Do not return -1 (EINVAL) on allocation errorZbigniew Jędrzejewski-Szmek2014-03-14
|
* socket.c: make use of union sockaddr_unionDaniel Buch2014-03-12
|
* core: introduce new RuntimeDirectory= and RuntimeDirectoryMode= unit settingsLennart Poettering2014-03-03
| | | | | As discussed on the ML these are useful to manage runtime directories below /run for services.
* core: add global settings for enabling CPUAccounting=, MemoryAccounting=, ↵Lennart Poettering2014-02-24
| | | | BlockIOAccounting= for all units at once
* api: in constructor function calls, always put the returned object pointer ↵Lennart Poettering2014-02-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.
* core: make sure to always go through both SIGTERM and SIGKILL states of unitsLennart Poettering2014-01-29
| | | | | | Given that we now have KillMode=mixed where SIGTERM might kill a smaller set than SIGKILL we need to make sure to always go explicitly throught the SIGKILL state to get the right end result.
* core: add function to tell when job will time outZbigniew Jędrzejewski-Szmek2014-01-27
| | | | | | Things will continue when either the job timeout or the unit timeout is reached. Add functionality to access that info.
* make socket_instantiate_service use cleanup gcc attributeMichael Scherer2014-01-11
|
* util: unify SO_PEERCRED/SO_PEERSEC invocationsLennart Poettering2013-12-24
| | | | | | Introduce new call getpeercred() which internally just uses SO_PEERCRED but checks if the returned data is actually useful due to namespace quirks.
* sd-daemon: introduce sd_watchdog_enabled() for parsing $WATCHDOG_USECLennart Poettering2013-12-22
| | | | | | | | Also, introduce a new environment variable named $WATCHDOG_PID which cotnains the PID of the process that is supposed to send the keep-alive events. This is similar how $LISTEN_FDS and $LISTEN_PID work together, and protects against confusing processes further down the process tree due to inherited environment.
* core: no need to list properties for PropertiesChanged messages anymoreLennart Poettering2013-12-22
| | | | Since the vtable includes this information anyway, let's just use that
* bus: when a busname unit refuses to activate a service it should flush the queueLennart Poettering2013-12-16
|
* bus: add .busname unit type to implement kdbus-style bus activationLennart Poettering2013-12-02
|
* service: add the ability for units to join other unit's PrivateNetwork= and ↵Lennart Poettering2013-11-27
| | | | PrivateTmp= namespaces
* core: convert PID 1 to libsystemd-busLennart Poettering2013-11-20
| | | | | | | | | | | | | | | | | | | | | | This patch converts PID 1 to libsystemd-bus and thus drops the dependency on libdbus. The only remaining code using libdbus is a test case that validates our bus marshalling against libdbus' marshalling, and this dependency can be turned off. This patch also adds a couple of things to libsystem-bus, that are necessary to make the port work: - Synthesizing of "Disconnected" messages when bus connections are severed. - Support for attaching multiple vtables for the same interface on the same path. This patch also fixes the SetDefaultTarget() and GetDefaultTarget() bus calls which used an inappropriate signature. As a side effect we will now generate PropertiesChanged messages which carry property contents, rather than just invalidation information.
* core/socket: fix SO_REUSEPORTShawn Landden2013-11-17
|
* core/socket: use _cleanup_free_Shawn Landden2013-11-17
|
* active: rework make_socket_fd() to be based on socket_address_listen()Lennart Poettering2013-11-06
| | | | | Among other things this makes sure we set SO_REUSEADDR which is immensely useful.
* Configurable Timeouts/Restarts default valuesOleksii Shevchuk2013-11-05
| | | | | | | https://bugs.freedesktop.org/show_bug.cgi?id=71132 Patch adds DefaultTimeoutStartSec, DefaultTimeoutStopSec, DefaultRestartSec configuration options to manager configuration file.
* list: make our list macros a bit easier to use by not requring type spec on ↵Lennart Poettering2013-10-14
| | | | | | | each invocation We can determine the list entry type via the typeof() gcc construct, and so we should to make the macros much shorter to use.
* smack: minimize ifdef use, and move all labeling to smack-util.cKay Sievers2013-10-11
|
* security: missing header inclusionsLennart Poettering2013-10-10
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-10 23:06:40 +0000