ndhc will fork off an ifchd child that it will communicate with via
pipes rather than by connecting to a SO_PEERCRED AF_UNIX socket.
The advantages include:
1. Simpler configuration. Much easier for users and packagers to set up.
2. Drastically less complex code for the ifch functionality. More code
is removed than added, and the result is a lot less complex.
3. Potentially better security. The ifch can only service the parent
ndhc process, and it is restricted to issuing modifications to
the single interface that ndhc manages.
4. Less memory used on systems that allow overcommit.
The downsides:
1. Possibly more memory used on systems that run multiple ndhcs and use
strict commit limits.
At the same time, use netlink rather than ioctls so that the
interface ip, subnet, and broadcast address can be set simultaneously.
This change reduces the netlink notification spam greatly.
The current code builds but isn't yet complete. Subsequent commits will
flesh things out and polish out some remaining issues.
DHCP messages anyway, since the IPv4 min MTU is 576 bytes and the max DHCP
message size + IP and UDP headers is less than that, but it is still worth
checking.
broken before because of too-strict filters.
Move setup_signals under the seccomp filter to give it more testing coverage.
Make the UDP datagram length check much more strict. If the read buffer
does not match up with the header lengths exactly, it is discarded.
Print a warning to syslog/stdout when ifchd execute_buffer() returns an
error.
Fix a regression introduced in ifchd that would cause the epoll handler to
spin when a client connection closed.
This change also modifies the ndhc/ifchd wire protocol slightly. The
new protocol doesn't overload the ':' character as a key:value separator
and a statement separator. Instead ';' is now used as a statement separator.
The new format allows for more robust error-checking and reporting, and it
greatly simplifies the parser. Old versions of ndhc/ifchd will not work
properly with ones compiled after this commit.
The 'domain' and 'search' keywords in resolv.conf updates are now used
more precisely. The first domain in an update is the 'domain', and the
subsequent 5 domains are 'search' domains.
There are also supporting cleanups that pass struct ifchd_client pointers
to functions instead of passing index values.
This commit is large, but it cannot really be broken up into smaller
chunks since the changes are dependent on each other.
ifchd just had empty hooks that never received work messages anyway.
Shorten the names of ifchd commands. This breaks wire protocol, but
thankfully I haven't released yet!
sure that it matches that of our associated DHCP server.
Normalize, prune, and beautify the appearance of log messages.
Minor cosmetic cleanups/refactoring.
