systemd: 247.1 -> 247.2 #107067

flokli · 2020-12-16T22:11:06Z

Contains the following fixes:

937118a5b2 journalctl: don't skip the entries that have the same seqnum
e017ac6a26 sd-bus: use SOCK_CLOEXEC on one more socket
db31432861 resolved: create stub-resolv.conf symlink with correct security label
f2ec15e2e5 efi: Only use arm flags if supported
cd43eee770 core: detect_container() may return negative errno
04be042a1f meson: Fix reallocarray check
5e906f483b network: do not assume address ready callback is always set to static addresses
2ad7a2a96a network: drop assertions to check link state in netlink callback handlers
f375c8cbb5 network: do not reconfigure interface when the link gains carrier but udev not initialized it yet
5d4909decf veritysetup: also place udev socket dep
57ddb74245 cryptsetup: Fix crypto device missing issue after bootup
d3c224d441 network: fix SIGABRT related to unreachable route with DHCP6
c91648cc83 network: revert previous changes to address_compare_func()
d8b5d8c8c3 udev: Fix sound.target dependency
669107ae68 meson: specify correct libqrencode version in meson dep
c07dc6cedc udev: link_update() should fail if the entry in symlink dir couldn't have been created
367006c806 man: document that automount units are privileged
5129808141 logind: fix closing of button input devices
37f06c91ef Update logind-button.c
9e9fda0a2d async: add trivial cleanup wrapper for asynchronous_close()
4a2ca1ca4a Silence cgroups v1 read-only filesystem warning
ed1f8f4ba2 manager: Fix HW watchdog when systemd starts before driver loaded
383a747164 cgroup: Also set blkio.bfq.weight
48d41091ac nss-resolve: varlink_call() set error_id only when r >= 0
56daba2deb missing: Define several syscall numbers for Alpha arch
f2a4b96276 Don't assume /run/systemd exists when creating unit-root
553530fdc7 mkosi: Add findutils to Fedora config
e42990dfe3 mkosi: Add rpm to Fedora BuildPackages as it's needed by pkg-config
6bacd1d971 mkosi: Replace iptables-dev with libiptc-dev in debian config
f1fc515c21 dissect: don't declare unused variables on archs that have no GPT discovery
30d0c3f58c resolved: synthesize NODATA instead of NXDOMAIN if gateway exists, but of other protocol
538ebbd7f3 local-addresses: make returning accumulated list optional
228a22bb63 resolved: improve log message when we use TCP a bit
aa31dd9128 network: ignore broadcast address for /31 or /32 addresses
85607cc094 network: fix verification for broadcast address
dc6ad6482a network: do not set broadcast if prefixlen is 31 or 32
39ee319c75 stub: don't ever respond to datagrams coming in on non-localhost addreses, on the stub
cbea0e5a83 resolved: never allow _gateway lookups to go to the network
c4df66816b resolved: lower SERVFAIL cache timeout from 30s to 10s
b5e39c20d9 dns-domain: try IDN2003 rules if IDN2008 doesn't work
2c354cedd2 virt: Properly detect nested UML inside another hypervisor
10f2cfb715 resolved: properly check per-link NTA list
a8437c07e4 meson: use '_' as separator in fuzz test names
81ef7623c8 man: mention that --key= is about secret keys
4ef70ecefc meson: check that cxx variable is set before using it

Things done

Contains the following fixes: - 937118a5b2 journalctl: don't skip the entries that have the same seqnum - e017ac6a26 sd-bus: use SOCK_CLOEXEC on one more socket - db31432861 resolved: create stub-resolv.conf symlink with correct security label - f2ec15e2e5 efi: Only use arm flags if supported - cd43eee770 core: detect_container() may return negative errno - 04be042a1f meson: Fix reallocarray check - 5e906f483b network: do not assume address ready callback is always set to static addresses - 2ad7a2a96a network: drop assertions to check link state in netlink callback handlers - f375c8cbb5 network: do not reconfigure interface when the link gains carrier but udev not initialized it yet - 5d4909decf veritysetup: also place udev socket dep - 57ddb74245 cryptsetup: Fix crypto device missing issue after bootup - d3c224d441 network: fix SIGABRT related to unreachable route with DHCP6 - c91648cc83 network: revert previous changes to address_compare_func() - d8b5d8c8c3 udev: Fix sound.target dependency - 669107ae68 meson: specify correct libqrencode version in meson dep - c07dc6cedc udev: link_update() should fail if the entry in symlink dir couldn't have been created - 367006c806 man: document that automount units are privileged - 5129808141 logind: fix closing of button input devices - 37f06c91ef Update logind-button.c - 9e9fda0a2d async: add trivial cleanup wrapper for asynchronous_close() - 4a2ca1ca4a Silence cgroups v1 read-only filesystem warning - ed1f8f4ba2 manager: Fix HW watchdog when systemd starts before driver loaded - 383a747164 cgroup: Also set blkio.bfq.weight - 48d41091ac nss-resolve: varlink_call() set error_id only when r >= 0 - 56daba2deb missing: Define several syscall numbers for Alpha arch - f2a4b96276 Don't assume /run/systemd exists when creating unit-root - 553530fdc7 mkosi: Add findutils to Fedora config - e42990dfe3 mkosi: Add rpm to Fedora BuildPackages as it's needed by pkg-config - 6bacd1d971 mkosi: Replace iptables-dev with libiptc-dev in debian config - f1fc515c21 dissect: don't declare unused variables on archs that have no GPT discovery - 30d0c3f58c resolved: synthesize NODATA instead of NXDOMAIN if gateway exists, but of other protocol - 538ebbd7f3 local-addresses: make returning accumulated list optional - 228a22bb63 resolved: improve log message when we use TCP a bit - aa31dd9128 network: ignore broadcast address for /31 or /32 addresses - 85607cc094 network: fix verification for broadcast address - dc6ad6482a network: do not set broadcast if prefixlen is 31 or 32 - 39ee319c75 stub: don't ever respond to datagrams coming in on non-localhost addreses, on the stub - cbea0e5a83 resolved: never allow _gateway lookups to go to the network - c4df66816b resolved: lower SERVFAIL cache timeout from 30s to 10s - b5e39c20d9 dns-domain: try IDN2003 rules if IDN2008 doesn't work - 2c354cedd2 virt: Properly detect nested UML inside another hypervisor - 10f2cfb715 resolved: properly check per-link NTA list - a8437c07e4 meson: use '_' as separator in fuzz test names - 81ef7623c8 man: mention that --key= is about *secret* keys - 4ef70ecefc meson: check that cxx variable is set before using it

ghost · 2020-12-17T03:45:19Z

I've updated all my systems and didn't encounter any issues.

TredwellGit · 2020-12-18T16:58:16Z

This appears to have broken systemd-resolved.

andir · 2020-12-18T17:10:29Z

In what sense? Do you have logs?

…

On 18 December 2020 17:58:31 CET, TredwellGit ***@***.***> wrote: This appears to have broken systemd-resolved. -- You are receiving this because your review was requested. Reply to this email directly or view it on GitHub: #107067 (comment)

-- Sent from my Android device with K-9 Mail. Please excuse my brevity.

TredwellGit · 2020-12-18T17:14:15Z

DNS does not resolve via systemd-resolved. The logs are no different from when it worked.

flokli · 2020-12-18T22:35:27Z

@TredwellGit can you get a bit more specific? What outputs do you get? How did you do the lookup?

Kloenk · 2020-12-18T23:52:29Z

resolved likes to be broken. From my experience it's sometimes due to misconfigurations and dhcp, as it has a per interface dns server.

ghost · 2020-12-19T00:15:02Z

Since there were changes related to resolved in 247.2 I would not dismiss it that quickly, but I can not reproduce the problem with a VM:

vm.nix:

{ pkgs, modulesPath, ... }:

{
  imports = [
    (modulesPath + "/virtualisation/qemu-vm.nix")
  ];

  services.resolved.enable = true;

  environment.systemPackages = with pkgs; [ dnsutils ];

  users.users.pbb = {
    isNormalUser = true;
    initialPassword = "hunter2";
    extraGroups = [ "wheel" ];
  };
}

Test with 247.1:

$ git checkout 91b8237b4839ca2e43c11ff3cc28606692748fff~1
$ nix build -f nixos -I nixos-config=vm.nix -I nixpkgs=$PWD config.system.build.vm
$ result/bin/run-nixos-vm

Result:

Test with 247.2:

$ git checkout 91b8237b4839ca2e43c11ff3cc28606692748fff
$ nix build -f nixos -I nixos-config=vm.nix -I nixpkgs=$PWD config.system.build.vm
$ result/bin/run-nixos-vm

Result:

As you can see both versions worked. I tried deleting the state (nixos.qcow2) in between, or upgrading the state from 247.1 to 247.2 without changes to the result. Only once when I closed the qemu window very quickly after starting the VM, resolved failed to start on the next boot (as in the service failed and a big red status entry was shown at startup), but after another restart it worked again.

TredwellGit · 2020-12-19T04:24:16Z

$ git checkout 91b8237b4839ca2e43c11ff3cc28606692748fff~1
$ nix build -f nixos -I nixos-config=vm.nix -I nixpkgs=$PWD config.system.build.vm
$ result/bin/run-nixos-vm

$ curl nixos.org
Redirecting to https://nixos.org/

$ git checkout 91b8237b4839ca2e43c11ff3cc28606692748fff
$ nix build -f nixos -I nixos-config=vm.nix -I nixpkgs=$PWD config.system.build.vm
$ result/bin/run-nixos-vm

$ curl nixos.org
curl: (6) Could not resolve host: nixos.org

ghost · 2020-12-19T11:10:25Z

Thanks for providing your test method. I can confirm this (dig works but curl or ping don't):

flokli · 2020-12-19T18:39:55Z

Can you try dig via the resolved stub resolver? There might be some transient, dnssec-downgrade-related failure - but not sure how that regressed from 247.1...

Kloenk · 2020-12-19T18:41:35Z

127.0.0.53 should be the stub resolver. Or what do you mean?

flokli · 2020-12-19T20:20:27Z

Yes, as in, how does dig @127.0.0.53 nixos.org behave, and what does resolved log while doing so.

ghost · 2020-12-19T20:38:12Z

The dig in my screenshot was already using 127.0.0.53 as server since it's in /etc/resolv.conf. So 127.0.0.53 does respond, but the glibc calls do not correctly resolve things.

TredwellGit · 2020-12-19T20:45:33Z

systemd/systemd#18025

flokli · 2020-12-20T12:18:25Z

@TredwellGit was that patch reverted by Archlinux for now?

flokli · 2020-12-20T12:23:40Z

Hm, Archlinux cherry-picked this before 247.2 was released, to fix a firefox crash? archlinux/svntogit-packages@8a4be64#diff-3e341d2d9c67be01819b25b25d5e53ea3cdf3a38d28846cda85a195eb9b7203a

MartinX3 · 2020-12-20T12:24:49Z

@flokli No, it was cherry picked before, but the cherry pick got removed, because it got merged upstream.
I doubt they will remove it, since it kills resolved only for some people like me
And in my issue ticket the systemd main developer set a milestone for v248

flokli · 2020-12-22T14:17:24Z

@MartinX3 considering the comment in systemd/systemd#18025 (comment), this seems to be only happening when systemd-resolved is enabled, and DNSOverTLS= is enabled too.

Both aren't enabled by default in NixOS, so I'm not sure if it's too much of a regression for now.

@petabyteboy could you reproduce the bug without setting DNSOverTLS=?

Kloenk · 2020-12-22T14:19:31Z

from this config

{ pkgs, modulesPath, ... }:

{
  imports = [
    (modulesPath + "/virtualisation/qemu-vm.nix")
  ];

  services.resolved.enable = true;

  environment.systemPackages = with pkgs; [ dnsutils ];

  users.users.pbb = {
    isNormalUser = true;
    initialPassword = "hunter2";
    extraGroups = [ "wheel" ];
  };
}

DNSOverTLS should have been not set. So guess it was without TLS.

MartinX3 · 2020-12-22T14:21:41Z

resolvectl should show the used setting :)

xaverdh · 2020-12-23T21:08:56Z

I also have this issue now after the recent staging merge / systemd update.
resolvectl says: Protocols: +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported
So I think its not using DNSOverTLS..

flokli · 2020-12-24T01:49:44Z

Please report in the upstream issue - this is not a NixOS-specific problem, and if this isn't only related to DNSOverTLS (as reported there!), upstream should know, so it can be fixed.

On the NixOS side of things, we could stop automatically enabling resolved when networkd is enabled to work this around (or figure out if certain resolved options migitate this), but upstream is where this should be fixed.

I'm also not sure if reverting this single commit is a good idea, given it seems to fix a firefox crash: #107067 (comment)

Really, the best way seems to be sorting this out upstream.

xaverdh · 2020-12-24T07:00:39Z

Might be the upstream issue. I took a second look at the debug output of resolved on my system though, and it also complains about not being able to find libidn2:
libidn2 support is not installed: libidn2.so.0: cannot open shared object file: No such file or directory
Not sure if that's relevant

flokli · 2020-12-24T07:43:56Z

Does it only fail on a punycode domain?

xaverdh · 2020-12-24T09:00:41Z

Does it only fail on a punycode domain?

Nope, also on ordinary domains.
Still its strange that it can't find libidn2, since its clearly in the buildInputs for systemd, and the corresponding build flag is set to true..

flokli · 2020-12-24T23:03:14Z

@xaverdh systemd changed some of their dependencies to become dlopen() at runtime, and apparently that codepath wasn't sufficiently tested: systemd/systemd#18078

This is tracked in #107537.

flokli requested review from andir, edolstra and picnoir December 16, 2020 22:11

ofborg bot added 11.by: package-maintainer 10.rebuild-darwin: 101-500 10.rebuild-linux: 501+ 10.rebuild-linux: 5001+ labels Dec 16, 2020

flokli mentioned this pull request Dec 16, 2020

nixos/network-interfaces-systemd: fix IPv6 privacy extensions #107061

Merged

10 tasks

ghost approved these changes Dec 17, 2020

View reviewed changes

FRidh self-assigned this Dec 17, 2020

FRidh merged commit 91b8237 into NixOS:staging Dec 17, 2020

flokli deleted the systemd-247.2 branch December 18, 2020 22:35

MartinX3 mentioned this pull request Dec 20, 2020

systemd-resolved broken since commit "nss-resolve: varlink_call() set error_id only when r >= 0" systemd/systemd#18025

Closed

flokli mentioned this pull request Dec 24, 2020

"optional" libidn2 in systemd-resolved breaks it entirely systemd/systemd#18078

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

systemd: 247.1 -> 247.2 #107067

systemd: 247.1 -> 247.2 #107067

flokli commented Dec 16, 2020

ghost commented Dec 17, 2020

TredwellGit commented Dec 18, 2020

andir commented Dec 18, 2020 via email

TredwellGit commented Dec 18, 2020

flokli commented Dec 18, 2020

Kloenk commented Dec 18, 2020

ghost commented Dec 19, 2020 •

edited by ghost

TredwellGit commented Dec 19, 2020

ghost commented Dec 19, 2020 •

edited by ghost

flokli commented Dec 19, 2020 via email

Kloenk commented Dec 19, 2020

flokli commented Dec 19, 2020 via email

ghost commented Dec 19, 2020

TredwellGit commented Dec 19, 2020

flokli commented Dec 20, 2020

flokli commented Dec 20, 2020

MartinX3 commented Dec 20, 2020

flokli commented Dec 22, 2020

Kloenk commented Dec 22, 2020

MartinX3 commented Dec 22, 2020

xaverdh commented Dec 23, 2020

flokli commented Dec 24, 2020 •

edited

xaverdh commented Dec 24, 2020

flokli commented Dec 24, 2020 via email

xaverdh commented Dec 24, 2020

flokli commented Dec 24, 2020 •

edited

systemd: 247.1 -> 247.2 #107067

systemd: 247.1 -> 247.2 #107067

Conversation

flokli commented Dec 16, 2020

Things done

ghost commented Dec 17, 2020

TredwellGit commented Dec 18, 2020

andir commented Dec 18, 2020 via email

TredwellGit commented Dec 18, 2020

flokli commented Dec 18, 2020

Kloenk commented Dec 18, 2020

ghost commented Dec 19, 2020 • edited by ghost

TredwellGit commented Dec 19, 2020

ghost commented Dec 19, 2020 • edited by ghost

flokli commented Dec 19, 2020 via email

Kloenk commented Dec 19, 2020

flokli commented Dec 19, 2020 via email

ghost commented Dec 19, 2020

TredwellGit commented Dec 19, 2020

flokli commented Dec 20, 2020

flokli commented Dec 20, 2020

MartinX3 commented Dec 20, 2020

flokli commented Dec 22, 2020

Kloenk commented Dec 22, 2020

MartinX3 commented Dec 22, 2020

xaverdh commented Dec 23, 2020

flokli commented Dec 24, 2020 • edited

xaverdh commented Dec 24, 2020

flokli commented Dec 24, 2020 via email

xaverdh commented Dec 24, 2020

flokli commented Dec 24, 2020 • edited

ghost commented Dec 19, 2020 •

edited by ghost

ghost commented Dec 19, 2020 •

edited by ghost

flokli commented Dec 24, 2020 •

edited

flokli commented Dec 24, 2020 •

edited