chiark / gitweb /
networkd: fix use-after-free
[elogind.git] / src / network / networkd-manager.c
index 1b3e71ab0eb7ac6a180cb200213c6bb0893355ba..ddbdabbff903ece3bbecde8fb76b87dbc09c243c 100644 (file)
 #include "udev-util.h"
 #include "rtnl-util.h"
 #include "mkdir.h"
+#include "virt.h"
 
 const char* const network_dirs[] = {
         "/etc/systemd/network",
         "/run/systemd/network",
         "/usr/lib/systemd/network",
-#ifdef HAVE_SPLIT_USER
+#ifdef HAVE_SPLIT_USR
         "/lib/systemd/network",
 #endif
         NULL};
 
+static int dispatch_sigterm(sd_event_source *es, const struct signalfd_siginfo *si, void *userdata) {
+        Manager *m = userdata;
+
+        assert(m);
+
+        log_received_signal(LOG_INFO, si);
+
+        sd_event_exit(m->event, 0);
+        return 0;
+}
+
+static int setup_signals(Manager *m) {
+        sigset_t mask;
+        int r;
+
+        assert(m);
+
+        assert_se(sigemptyset(&mask) == 0);
+        sigset_add_many(&mask, SIGINT, SIGTERM, -1);
+        assert_se(sigprocmask(SIG_SETMASK, &mask, NULL) == 0);
+
+        r = sd_event_add_signal(m->event, &m->sigterm_event_source, SIGTERM, dispatch_sigterm, m);
+        if (r < 0)
+                return r;
+
+        r = sd_event_add_signal(m->event, &m->sigint_event_source, SIGINT, dispatch_sigterm, m);
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
 int manager_new(Manager **ret) {
         _cleanup_manager_free_ Manager *m = NULL;
         int r;
@@ -51,7 +84,7 @@ int manager_new(Manager **ret) {
 
         sd_event_set_watchdog(m->event, true);
 
-        r = sd_rtnl_open(RTMGRP_LINK | RTMGRP_IPV4_IFADDR, &m->rtnl);
+        r = sd_rtnl_open(&m->rtnl, RTMGRP_LINK | RTMGRP_IPV4_IFADDR);
         if (r < 0)
                 return r;
 
@@ -59,13 +92,26 @@ int manager_new(Manager **ret) {
         if (r < 0 && r != -ENOENT) /* TODO: drop when we can rely on kdbus */
                 return r;
 
+        r = setup_signals(m);
+        if (r < 0)
+                return r;
+
         m->udev = udev_new();
         if (!m->udev)
                 return -ENOMEM;
 
-        m->udev_monitor = udev_monitor_new_from_netlink(m->udev, "udev");
-        if (!m->udev_monitor)
-                return -ENOMEM;
+        /* udev does not initialize devices inside containers,
+         * so we rely on them being already initialized before
+         * entering the container */
+        if (detect_container(NULL) > 0) {
+                m->udev_monitor = udev_monitor_new_from_netlink(m->udev, "kernel");
+                if (!m->udev_monitor)
+                        return -ENOMEM;
+        } else {
+                m->udev_monitor = udev_monitor_new_from_netlink(m->udev, "udev");
+                if (!m->udev_monitor)
+                        return -ENOMEM;
+        }
 
         m->links = hashmap_new(uint64_hash_func, uint64_compare_func);
         if (!m->links)
@@ -85,22 +131,27 @@ int manager_new(Manager **ret) {
 
 void manager_free(Manager *m) {
         Network *network;
-        Netdev *netdev;
+        NetDev *netdev;
         Link *link;
 
+        if (!m)
+                return;
+
         udev_monitor_unref(m->udev_monitor);
         udev_unref(m->udev);
         sd_bus_unref(m->bus);
         sd_event_source_unref(m->udev_event_source);
+        sd_event_source_unref(m->sigterm_event_source);
+        sd_event_source_unref(m->sigint_event_source);
         sd_event_unref(m->event);
 
-        while ((network = m->networks))
-                network_free(network);
-
         while ((link = hashmap_first(m->links)))
                 link_free(link);
         hashmap_free(m->links);
 
+        while ((network = m->networks))
+                network_free(network);
+
         while ((netdev = hashmap_first(m->netdevs)))
                 netdev_free(netdev);
         hashmap_free(m->netdevs);
@@ -132,30 +183,31 @@ bool manager_should_reload(Manager *m) {
 }
 
 static int manager_process_link(Manager *m, struct udev_device *device) {
-        Link *link;
+        Link *link = NULL;
         int r;
 
-        if (streq_ptr(udev_device_get_action(device), "remove")) {
-                uint64_t ifindex;
+        assert(m);
+        assert(device);
 
+        link_get(m, udev_device_get_ifindex(device), &link);
+
+        if (streq_ptr(udev_device_get_action(device), "remove")) {
                 log_debug("%s: link removed", udev_device_get_sysname(device));
 
-                ifindex = udev_device_get_ifindex(device);
-                link = hashmap_get(m->links, &ifindex);
-                if (!link)
+                if (link)
+                        link_free(link);
+        } else {
+                if (link) {
+                        log_debug("%s: link already exists, ignoring",
+                                  link->ifname);
                         return 0;
+                }
 
-                link_free(link);
-        } else {
                 r = link_add(m, device, &link);
                 if (r < 0) {
-                        if (r == -EEXIST)
-                                log_debug("%s: link already exists, ignoring",
-                                          link->ifname);
-                        else
-                                log_error("%s: could not handle link: %s",
-                                          udev_device_get_sysname(device),
-                                          strerror(-r));
+                        log_error("%s: could not handle link: %s",
+                                  udev_device_get_sysname(device),
+                                  strerror(-r));
                 } else
                         log_debug("%s: link (with ifindex %" PRIu64") added",
                                   link->ifname, link->ifindex);
@@ -179,9 +231,14 @@ int manager_udev_enumerate_links(Manager *m) {
         if (r < 0)
                 return r;
 
-        r = udev_enumerate_add_match_is_initialized(e);
-        if (r < 0)
-                return r;
+        /* udev does not initialize devices inside containers,
+         * so we rely on them being already initialized before
+         * entering the container */
+        if (detect_container(NULL) <= 0) {
+                r = udev_enumerate_add_match_is_initialized(e);
+                if (r < 0)
+                        return r;
+        }
 
         r = udev_enumerate_scan_devices(e);
         if (r < 0)
@@ -233,9 +290,10 @@ int manager_udev_listen(Manager *m) {
         }
 
         r = sd_event_add_io(m->event,
+                        &m->udev_event_source,
                         udev_monitor_get_fd(m->udev_monitor),
                         EPOLLIN, manager_dispatch_link_udev,
-                        m, &m->udev_event_source);
+                        m);
         if (r < 0)
                 return r;
 
@@ -245,34 +303,32 @@ int manager_udev_listen(Manager *m) {
 static int manager_rtnl_process_link(sd_rtnl *rtnl, sd_rtnl_message *message, void *userdata) {
         Manager *m = userdata;
         Link *link;
-        const char *name;
-        uint64_t ifindex_64;
+        char *name;
         int r, ifindex;
 
+        assert(rtnl);
+        assert(message);
+        assert(m);
+
         r = sd_rtnl_message_link_get_ifindex(message, &ifindex);
         if (r < 0 || ifindex <= 0) {
-                log_debug("received RTM_NEWLINK message without valid ifindex");
+                log_warning("received RTM_NEWLINK message without valid ifindex");
                 return 0;
         }
 
-        r = rtnl_message_link_get_ifname(message, &name);
+        r = sd_rtnl_message_read_string(message, IFLA_IFNAME, &name);
         if (r < 0)
-                log_debug("received RTM_NEWLINK message without valid IFLA_IFNAME");
+                log_warning("received RTM_NEWLINK message without valid ifname");
         else {
-                Netdev *netdev;
+                NetDev *netdev;
 
                 r = netdev_get(m, name, &netdev);
-                if (r >= 0) {
-                        r = netdev_set_ifindex(netdev, ifindex);
-                        if (r < 0)
-                                log_debug("could not set ifindex of netdev '%s' to %d: %s",
-                                          name, ifindex, strerror(-r));
-                }
+                if (r >= 0)
+                        netdev_set_ifindex(netdev, message);
         }
 
-        ifindex_64 = ifindex;
-        link = hashmap_get(m->links, &ifindex_64);
-        if (!link) {
+        r = link_get(m, ifindex, &link);
+        if (r < 0) {
                 log_debug("received RTM_NEWLINK message for untracked ifindex %d", ifindex);
                 return 0;
         }
@@ -347,10 +403,6 @@ int manager_update_resolv_conf(Manager *m) {
 
         assert(m);
 
-        r = mkdir_safe_label("/run/systemd/network", 0755, 0, 0);
-        if (r < 0)
-                return r;
-
         r = fopen_temporary("/run/systemd/network/resolv.conf", &f, &temp_path);
         if (r < 0)
                 return r;
@@ -386,10 +438,17 @@ int manager_update_resolv_conf(Manager *m) {
                 }
         }
 
-        HASHMAP_FOREACH(link, m->links, i)
-                if (link->network && link->network->dns)
-                        append_dns(f, &link->network->dns->in_addr.in,
-                                   link->network->dns->family, &count);
+        HASHMAP_FOREACH(link, m->links, i) {
+                if (link->network && link->network->dns) {
+                        Address *address;
+                        Iterator j;
+
+                        SET_FOREACH(address, link->network->dns, j) {
+                                append_dns(f, &address->in_addr.in,
+                                           address->family, &count);
+                        }
+                }
+        }
 
         fflush(f);