From 41afafbf2a1b248bee77d6c9e5d73cee63595bb2 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 16 Sep 2024 09:19:21 +0900 Subject: [PATCH 1/7] network/sysctl-monitor: fix sanity check in cut_last() This also adds basic comment about the return code. Follow-up for 6d9ef22acdeac4b429efb75164341233955484af. --- .../bpf/sysctl_monitor/sysctl-monitor.bpf.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/src/network/bpf/sysctl_monitor/sysctl-monitor.bpf.c b/src/network/bpf/sysctl_monitor/sysctl-monitor.bpf.c index ef154931ce..e0ec8489d2 100644 --- a/src/network/bpf/sysctl_monitor/sysctl-monitor.bpf.c +++ b/src/network/bpf/sysctl_monitor/sysctl-monitor.bpf.c @@ -36,23 +36,22 @@ struct str { static long cut_last(u32 i, struct str *str) { char *s; + /* Sanity check for the preverifier */ + if (i >= str->l) + return 1; /* exit from the loop */ + i = str->l - i - 1; s = str->s + i; - /* Sanity check for the preverifier */ - if (i >= str->l) - return 1; - if (*s == 0) - return 0; + return 0; /* continue */ if (*s == '\n' || *s == '\r' || *s == ' ' || *s == '\t') { *s = 0; - - return 0; + return 0; /* continue */ } - return 1; + return 1; /* exit from the loop */ } /* Cut off trailing whitespace and newlines */ From 9295c7ae09e4151f6fa0ddebb3a50463927738d8 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 16 Sep 2024 09:33:58 +0900 Subject: [PATCH 2/7] network/sysctl: use wrapped free functions No functional change, just refactoring. Follow-up for 6d9ef22acdeac4b429efb75164341233955484af. --- src/network/networkd-sysctl.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) diff --git a/src/network/networkd-sysctl.c b/src/network/networkd-sysctl.c index 4c83a6c9a9..667c4408dd 100644 --- a/src/network/networkd-sysctl.c +++ b/src/network/networkd-sysctl.c @@ -163,22 +163,9 @@ void sysctl_remove_monitor(Manager *manager) { assert(manager); manager->sysctl_event_source = sd_event_source_disable_unref(manager->sysctl_event_source); - - if (manager->sysctl_buffer) { - sym_ring_buffer__free(manager->sysctl_buffer); - manager->sysctl_buffer = NULL; - } - - if (manager->sysctl_link) { - sym_bpf_link__destroy(manager->sysctl_link); - manager->sysctl_link = NULL; - } - - if (manager->sysctl_skel) { - sysctl_monitor_bpf__destroy(manager->sysctl_skel); - manager->sysctl_skel = NULL; - } - + manager->sysctl_buffer = rb_free(manager->sysctl_buffer); + manager->sysctl_link = bpf_link_free(manager->sysctl_link); + manager->sysctl_skel = sysctl_monitor_bpf_free(manager->sysctl_skel); manager->cgroup_fd = safe_close(manager->cgroup_fd); } From 46718d344fdaaaf523d854a0c728197e7406a55a Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 16 Sep 2024 09:43:18 +0900 Subject: [PATCH 3/7] bpf-link: introduce bpf_ring_buffer_free() and friends Then, replace rb_free() in networkd. Follow-up for 6d9ef22acdeac4b429efb75164341233955484af. --- src/network/networkd-sysctl.c | 10 ++-------- src/nsresourced/nsresourced-manager.c | 4 ++-- src/shared/bpf-link.c | 9 ++++++++- src/shared/bpf-link.h | 5 ++++- 4 files changed, 16 insertions(+), 12 deletions(-) diff --git a/src/network/networkd-sysctl.c b/src/network/networkd-sysctl.c index 667c4408dd..2b9e860c81 100644 --- a/src/network/networkd-sysctl.c +++ b/src/network/networkd-sysctl.c @@ -34,13 +34,7 @@ static struct sysctl_monitor_bpf* sysctl_monitor_bpf_free(struct sysctl_monitor_ return NULL; } -static struct ring_buffer* rb_free(struct ring_buffer *rb) { - sym_ring_buffer__free(rb); - return NULL; -} - DEFINE_TRIVIAL_CLEANUP_FUNC(struct sysctl_monitor_bpf *, sysctl_monitor_bpf_free); -DEFINE_TRIVIAL_CLEANUP_FUNC(struct ring_buffer *, rb_free); static int sysctl_event_handler(void *ctx, void *data, size_t data_sz) { struct sysctl_write_event *we = ASSERT_PTR(data); @@ -99,7 +93,7 @@ static int on_ringbuf_io(sd_event_source *s, int fd, uint32_t revents, void *use int sysctl_add_monitor(Manager *manager) { _cleanup_(sysctl_monitor_bpf_freep) struct sysctl_monitor_bpf *obj = NULL; _cleanup_(bpf_link_freep) struct bpf_link *sysctl_link = NULL; - _cleanup_(rb_freep) struct ring_buffer *sysctl_buffer = NULL; + _cleanup_(bpf_ring_buffer_freep) struct ring_buffer *sysctl_buffer = NULL; _cleanup_close_ int cgroup_fd = -EBADF, rootcg = -EBADF; _cleanup_free_ char *cgroup = NULL; int idx = 0, r; @@ -163,7 +157,7 @@ void sysctl_remove_monitor(Manager *manager) { assert(manager); manager->sysctl_event_source = sd_event_source_disable_unref(manager->sysctl_event_source); - manager->sysctl_buffer = rb_free(manager->sysctl_buffer); + manager->sysctl_buffer = bpf_ring_buffer_free(manager->sysctl_buffer); manager->sysctl_link = bpf_link_free(manager->sysctl_link); manager->sysctl_skel = sysctl_monitor_bpf_free(manager->sysctl_skel); manager->cgroup_fd = safe_close(manager->cgroup_fd); diff --git a/src/nsresourced/nsresourced-manager.c b/src/nsresourced/nsresourced-manager.c index d87da586f7..43a00d6cef 100644 --- a/src/nsresourced/nsresourced-manager.c +++ b/src/nsresourced/nsresourced-manager.c @@ -6,6 +6,7 @@ #include "sd-daemon.h" #include "bpf-dlopen.h" +#include "bpf-link.h" #include "build-path.h" #include "common-signal.h" #include "env-util.h" @@ -141,8 +142,7 @@ Manager* manager_free(Manager *m) { #if HAVE_VMLINUX_H sd_event_source_disable_unref(m->userns_restrict_bpf_ring_buffer_event_source); - if (m->userns_restrict_bpf_ring_buffer) - sym_ring_buffer__free(m->userns_restrict_bpf_ring_buffer); + bpf_ring_buffer_free(m->userns_restrict_bpf_ring_buffer); userns_restrict_bpf_free(m->userns_restrict_bpf); #endif diff --git a/src/shared/bpf-link.c b/src/shared/bpf-link.c index 77f6a4ee9a..c83ebd4804 100644 --- a/src/shared/bpf-link.c +++ b/src/shared/bpf-link.c @@ -31,7 +31,7 @@ int bpf_serialize_link(FILE *f, FDSet *fds, const char *key, struct bpf_link *li return serialize_fd(f, fds, key, sym_bpf_link__fd(link)); } -struct bpf_link *bpf_link_free(struct bpf_link *link) { +struct bpf_link* bpf_link_free(struct bpf_link *link) { /* If libbpf wasn't dlopen()ed, sym_bpf_link__destroy might be unresolved (NULL), so let's not try to * call it if link is NULL. link might also be a non-null "error pointer", but such a value can only * originate from a call to libbpf, but that means that libbpf is available, and we can let @@ -41,3 +41,10 @@ struct bpf_link *bpf_link_free(struct bpf_link *link) { return NULL; } + +struct ring_buffer* bpf_ring_buffer_free(struct ring_buffer *rb) { + if (rb) /* See the comment in bpf_link_free(). */ + sym_ring_buffer__free(rb); + + return NULL; +} diff --git a/src/shared/bpf-link.h b/src/shared/bpf-link.h index 38aa080862..c66bf38eae 100644 --- a/src/shared/bpf-link.h +++ b/src/shared/bpf-link.h @@ -12,5 +12,8 @@ bool bpf_can_link_program(struct bpf_program *prog); int bpf_serialize_link(FILE *f, FDSet *fds, const char *key, struct bpf_link *link); -struct bpf_link *bpf_link_free(struct bpf_link *p); +struct bpf_link* bpf_link_free(struct bpf_link *p); DEFINE_TRIVIAL_CLEANUP_FUNC(struct bpf_link *, bpf_link_free); + +struct ring_buffer* bpf_ring_buffer_free(struct ring_buffer *rb); +DEFINE_TRIVIAL_CLEANUP_FUNC(struct ring_buffer *, bpf_ring_buffer_free); From 7c778cecdb47a61743ba5eb9d5a1d6d28e1f318f Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 16 Sep 2024 09:58:51 +0900 Subject: [PATCH 4/7] network/sysctl: several cleanups for sysctl_add_monitor() - rename rootcg -> root_cgroup_fd, to emphasize it is a fd, - drop nested function call, and check error code. --- src/network/networkd-sysctl.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/src/network/networkd-sysctl.c b/src/network/networkd-sysctl.c index 2b9e860c81..e7b421959a 100644 --- a/src/network/networkd-sysctl.c +++ b/src/network/networkd-sysctl.c @@ -94,9 +94,9 @@ int sysctl_add_monitor(Manager *manager) { _cleanup_(sysctl_monitor_bpf_freep) struct sysctl_monitor_bpf *obj = NULL; _cleanup_(bpf_link_freep) struct bpf_link *sysctl_link = NULL; _cleanup_(bpf_ring_buffer_freep) struct ring_buffer *sysctl_buffer = NULL; - _cleanup_close_ int cgroup_fd = -EBADF, rootcg = -EBADF; + _cleanup_close_ int cgroup_fd = -EBADF, root_cgroup_fd = -EBADF; _cleanup_free_ char *cgroup = NULL; - int idx = 0, r; + int idx = 0, r, fd; assert(manager); @@ -110,9 +110,9 @@ int sysctl_add_monitor(Manager *manager) { if (r < 0) return log_warning_errno(r, "Failed to get cgroup path, ignoring: %m."); - rootcg = cg_path_open(SYSTEMD_CGROUP_CONTROLLER, "/"); - if (rootcg < 0) - return log_warning_errno(rootcg, "Failed to open cgroup, ignoring: %m."); + root_cgroup_fd = cg_path_open(SYSTEMD_CGROUP_CONTROLLER, "/"); + if (root_cgroup_fd < 0) + return log_warning_errno(root_cgroup_fd, "Failed to open cgroup, ignoring: %m."); obj = sysctl_monitor_bpf__open_and_load(); if (!obj) { @@ -127,21 +127,27 @@ int sysctl_add_monitor(Manager *manager) { if (sym_bpf_map_update_elem(sym_bpf_map__fd(obj->maps.cgroup_map), &idx, &cgroup_fd, BPF_ANY)) return log_warning_errno(errno, "Failed to update cgroup map: %m"); - sysctl_link = sym_bpf_program__attach_cgroup(obj->progs.sysctl_monitor, rootcg); + sysctl_link = sym_bpf_program__attach_cgroup(obj->progs.sysctl_monitor, root_cgroup_fd); r = bpf_get_error_translated(sysctl_link); if (r < 0) { log_info_errno(r, "Unable to attach sysctl monitor BPF program to cgroup, ignoring: %m."); return 0; } - sysctl_buffer = sym_ring_buffer__new( - sym_bpf_map__fd(obj->maps.written_sysctls), - sysctl_event_handler, &manager->sysctl_shadow, NULL); + fd = sym_bpf_map__fd(obj->maps.written_sysctls); + if (fd < 0) + return log_warning_errno(fd, "Failed to get fd of sysctl maps: %m"); + + sysctl_buffer = sym_ring_buffer__new(fd, sysctl_event_handler, &manager->sysctl_shadow, NULL); if (!sysctl_buffer) return log_warning_errno(errno, "Failed to create ring buffer: %m"); + fd = sym_ring_buffer__epoll_fd(sysctl_buffer); + if (fd < 0) + return log_warning_errno(fd, "Failed to get poll fd of ring buffer: %m"); + r = sd_event_add_io(manager->event, &manager->sysctl_event_source, - sym_ring_buffer__epoll_fd(sysctl_buffer), EPOLLIN, on_ringbuf_io, sysctl_buffer); + fd, EPOLLIN, on_ringbuf_io, sysctl_buffer); if (r < 0) return log_warning_errno(r, "Failed to watch sysctl event ringbuffer: %m"); From a2fbe9f3f9938cf3e6fcfad9fe6fc9044f990fe8 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 16 Sep 2024 15:08:36 +0900 Subject: [PATCH 5/7] network/sysctl-monitor: fix use-after-free Previously, manager_free() did not assign NULL to Manager.sysctl_shadow, hence sysctl_clear_link_shadows() called by link_free() will causes use-after-free. To fix the issue, this makes Manager.sysctl_shadow will be set to NULL after it is freed, Fixes a bug introduced by 6d9ef22acdeac4b429efb75164341233955484af. --- src/network/networkd-manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/network/networkd-manager.c b/src/network/networkd-manager.c index 9925f3c25a..631ab85562 100644 --- a/src/network/networkd-manager.c +++ b/src/network/networkd-manager.c @@ -624,7 +624,7 @@ Manager* manager_free(Manager *m) { HASHMAP_FOREACH(link, m->links_by_index) (void) link_stop_engines(link, true); - hashmap_free(m->sysctl_shadow); + m->sysctl_shadow = hashmap_free(m->sysctl_shadow); m->request_queue = ordered_set_free(m->request_queue); m->remove_request_queue = ordered_set_free(m->remove_request_queue); From 099ee34ca187a5c7f3cc94f1f278df50f1ee9455 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 16 Sep 2024 15:10:46 +0900 Subject: [PATCH 6/7] network/sysctl-monitor: do not allocate sysctl_shadow when eBPF is not supported When eBPF is disabled, the hashmap will be never used. Let's not allocate it. --- src/network/networkd-ipv6ll.c | 4 ++-- src/network/networkd-manager.c | 2 -- src/network/networkd-manager.h | 8 ++++++++ src/network/networkd-ndisc.c | 6 +++--- src/network/networkd-sysctl.c | 35 +++++++++++++++++----------------- 5 files changed, 31 insertions(+), 24 deletions(-) diff --git a/src/network/networkd-ipv6ll.c b/src/network/networkd-ipv6ll.c index 0daf3ad8ab..04f51ab530 100644 --- a/src/network/networkd-ipv6ll.c +++ b/src/network/networkd-ipv6ll.c @@ -221,7 +221,7 @@ int link_set_ipv6ll_stable_secret(Link *link) { } return sysctl_write_ip_property(AF_INET6, link->ifname, "stable_secret", - IN6_ADDR_TO_STRING(&a), &link->manager->sysctl_shadow); + IN6_ADDR_TO_STRING(&a), manager_get_sysctl_shadow(link->manager)); } int link_set_ipv6ll_addrgen_mode(Link *link, IPv6LinkLocalAddressGenMode mode) { @@ -232,7 +232,7 @@ int link_set_ipv6ll_addrgen_mode(Link *link, IPv6LinkLocalAddressGenMode mode) { if (mode == link->ipv6ll_address_gen_mode) return 0; - return sysctl_write_ip_property_uint32(AF_INET6, link->ifname, "addr_gen_mode", mode, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_uint32(AF_INET6, link->ifname, "addr_gen_mode", mode, manager_get_sysctl_shadow(link->manager)); } static const char* const ipv6_link_local_address_gen_mode_table[_IPV6_LINK_LOCAL_ADDRESS_GEN_MODE_MAX] = { diff --git a/src/network/networkd-manager.c b/src/network/networkd-manager.c index 631ab85562..f172e0d865 100644 --- a/src/network/networkd-manager.c +++ b/src/network/networkd-manager.c @@ -624,8 +624,6 @@ Manager* manager_free(Manager *m) { HASHMAP_FOREACH(link, m->links_by_index) (void) link_stop_engines(link, true); - m->sysctl_shadow = hashmap_free(m->sysctl_shadow); - m->request_queue = ordered_set_free(m->request_queue); m->remove_request_queue = ordered_set_free(m->remove_request_queue); diff --git a/src/network/networkd-manager.h b/src/network/networkd-manager.h index 5a0decced2..9a310c2eab 100644 --- a/src/network/networkd-manager.h +++ b/src/network/networkd-manager.h @@ -150,4 +150,12 @@ int manager_set_timezone(Manager *m, const char *timezone); int manager_reload(Manager *m, sd_bus_message *message); +static inline Hashmap** manager_get_sysctl_shadow(Manager *manager) { +#if HAVE_VMLINUX_H + return &ASSERT_PTR(manager)->sysctl_shadow; +#else + return NULL; +#endif +} + DEFINE_TRIVIAL_CLEANUP_FUNC(Manager*, manager_free); diff --git a/src/network/networkd-ndisc.c b/src/network/networkd-ndisc.c index 81835c06e5..529311f4a4 100644 --- a/src/network/networkd-ndisc.c +++ b/src/network/networkd-ndisc.c @@ -987,7 +987,7 @@ static int ndisc_router_process_reachable_time(Link *link, sd_ndisc_router *rt) } /* Set the reachable time for Neighbor Solicitations. */ - r = sysctl_write_ip_neighbor_property_uint32(AF_INET6, link->ifname, "base_reachable_time_ms", (uint32_t) msec, &link->manager->sysctl_shadow); + r = sysctl_write_ip_neighbor_property_uint32(AF_INET6, link->ifname, "base_reachable_time_ms", (uint32_t) msec, manager_get_sysctl_shadow(link->manager)); if (r < 0) log_link_warning_errno(link, r, "Failed to apply neighbor reachable time (%"PRIu64"), ignoring: %m", msec); @@ -1021,7 +1021,7 @@ static int ndisc_router_process_retransmission_time(Link *link, sd_ndisc_router } /* Set the retransmission time for Neighbor Solicitations. */ - r = sysctl_write_ip_neighbor_property_uint32(AF_INET6, link->ifname, "retrans_time_ms", (uint32_t) msec, &link->manager->sysctl_shadow); + r = sysctl_write_ip_neighbor_property_uint32(AF_INET6, link->ifname, "retrans_time_ms", (uint32_t) msec, manager_get_sysctl_shadow(link->manager)); if (r < 0) log_link_warning_errno(link, r, "Failed to apply neighbor retransmission time (%"PRIu64"), ignoring: %m", msec); @@ -1057,7 +1057,7 @@ static int ndisc_router_process_hop_limit(Link *link, sd_ndisc_router *rt) { if (hop_limit <= 0) return 0; - r = sysctl_write_ip_property_uint32(AF_INET6, link->ifname, "hop_limit", (uint32_t) hop_limit, &link->manager->sysctl_shadow); + r = sysctl_write_ip_property_uint32(AF_INET6, link->ifname, "hop_limit", (uint32_t) hop_limit, manager_get_sysctl_shadow(link->manager)); if (r < 0) log_link_warning_errno(link, r, "Failed to apply hop_limit (%u), ignoring: %m", hop_limit); diff --git a/src/network/networkd-sysctl.c b/src/network/networkd-sysctl.c index e7b421959a..7330c2cc76 100644 --- a/src/network/networkd-sysctl.c +++ b/src/network/networkd-sysctl.c @@ -167,6 +167,7 @@ void sysctl_remove_monitor(Manager *manager) { manager->sysctl_link = bpf_link_free(manager->sysctl_link); manager->sysctl_skel = sysctl_monitor_bpf_free(manager->sysctl_skel); manager->cgroup_fd = safe_close(manager->cgroup_fd); + manager->sysctl_shadow = hashmap_free(manager->sysctl_shadow); } int sysctl_clear_link_shadows(Link *link) { @@ -209,13 +210,13 @@ static void manager_set_ip_forwarding(Manager *manager, int family) { return; /* keep */ /* First, set the default value. */ - r = sysctl_write_ip_property_boolean(family, "default", "forwarding", t, &manager->sysctl_shadow); + r = sysctl_write_ip_property_boolean(family, "default", "forwarding", t, manager_get_sysctl_shadow(manager)); if (r < 0) log_warning_errno(r, "Failed to %s the default %s forwarding: %m", enable_disable(t), af_to_ipv4_ipv6(family)); /* Then, set the value to all interfaces. */ - r = sysctl_write_ip_property_boolean(family, "all", "forwarding", t, &manager->sysctl_shadow); + r = sysctl_write_ip_property_boolean(family, "all", "forwarding", t, manager_get_sysctl_shadow(manager)); if (r < 0) log_warning_errno(r, "Failed to %s %s forwarding for all interfaces: %m", enable_disable(t), af_to_ipv4_ipv6(family)); @@ -260,7 +261,7 @@ static int link_update_ipv6_sysctl(Link *link) { if (!link_ipv6_enabled(link)) return 0; - return sysctl_write_ip_property_boolean(AF_INET6, link->ifname, "disable_ipv6", false, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_boolean(AF_INET6, link->ifname, "disable_ipv6", false, manager_get_sysctl_shadow(link->manager)); } static int link_set_proxy_arp(Link *link) { @@ -273,7 +274,7 @@ static int link_set_proxy_arp(Link *link) { if (link->network->proxy_arp < 0) return 0; - return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "proxy_arp", link->network->proxy_arp > 0, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "proxy_arp", link->network->proxy_arp > 0, manager_get_sysctl_shadow(link->manager)); } static int link_set_proxy_arp_pvlan(Link *link) { @@ -286,7 +287,7 @@ static int link_set_proxy_arp_pvlan(Link *link) { if (link->network->proxy_arp_pvlan < 0) return 0; - return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "proxy_arp_pvlan", link->network->proxy_arp_pvlan > 0, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "proxy_arp_pvlan", link->network->proxy_arp_pvlan > 0, manager_get_sysctl_shadow(link->manager)); } int link_get_ip_forwarding(Link *link, int family) { @@ -328,7 +329,7 @@ static int link_set_ip_forwarding_impl(Link *link, int family) { if (t < 0) return 0; /* keep */ - r = sysctl_write_ip_property_boolean(family, link->ifname, "forwarding", t, &link->manager->sysctl_shadow); + r = sysctl_write_ip_property_boolean(family, link->ifname, "forwarding", t, manager_get_sysctl_shadow(link->manager)); if (r < 0) return log_link_warning_errno(link, r, "Failed to %s %s forwarding, ignoring: %m", enable_disable(t), af_to_ipv4_ipv6(family)); @@ -405,7 +406,7 @@ static int link_set_ipv4_rp_filter(Link *link) { if (link->network->ipv4_rp_filter < 0) return 0; - return sysctl_write_ip_property_int(AF_INET, link->ifname, "rp_filter", link->network->ipv4_rp_filter, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_int(AF_INET, link->ifname, "rp_filter", link->network->ipv4_rp_filter, manager_get_sysctl_shadow(link->manager)); } static int link_set_ipv6_privacy_extensions(Link *link) { @@ -425,7 +426,7 @@ static int link_set_ipv6_privacy_extensions(Link *link) { if (val == IPV6_PRIVACY_EXTENSIONS_KERNEL) return 0; - return sysctl_write_ip_property_int(AF_INET6, link->ifname, "use_tempaddr", (int) val, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_int(AF_INET6, link->ifname, "use_tempaddr", (int) val, manager_get_sysctl_shadow(link->manager)); } static int link_set_ipv6_accept_ra(Link *link) { @@ -435,7 +436,7 @@ static int link_set_ipv6_accept_ra(Link *link) { if (!link_is_configured_for_family(link, AF_INET6)) return 0; - return sysctl_write_ip_property(AF_INET6, link->ifname, "accept_ra", "0", &link->manager->sysctl_shadow); + return sysctl_write_ip_property(AF_INET6, link->ifname, "accept_ra", "0", manager_get_sysctl_shadow(link->manager)); } static int link_set_ipv6_dad_transmits(Link *link) { @@ -448,7 +449,7 @@ static int link_set_ipv6_dad_transmits(Link *link) { if (link->network->ipv6_dad_transmits < 0) return 0; - return sysctl_write_ip_property_int(AF_INET6, link->ifname, "dad_transmits", link->network->ipv6_dad_transmits, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_int(AF_INET6, link->ifname, "dad_transmits", link->network->ipv6_dad_transmits, manager_get_sysctl_shadow(link->manager)); } static int link_set_ipv6_hop_limit(Link *link) { @@ -461,7 +462,7 @@ static int link_set_ipv6_hop_limit(Link *link) { if (link->network->ipv6_hop_limit <= 0) return 0; - return sysctl_write_ip_property_int(AF_INET6, link->ifname, "hop_limit", link->network->ipv6_hop_limit, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_int(AF_INET6, link->ifname, "hop_limit", link->network->ipv6_hop_limit, manager_get_sysctl_shadow(link->manager)); } static int link_set_ipv6_retransmission_time(Link *link) { @@ -480,7 +481,7 @@ static int link_set_ipv6_retransmission_time(Link *link) { if (retrans_time_ms <= 0 || retrans_time_ms > UINT32_MAX) return 0; - return sysctl_write_ip_neighbor_property_uint32(AF_INET6, link->ifname, "retrans_time_ms", retrans_time_ms, &link->manager->sysctl_shadow); + return sysctl_write_ip_neighbor_property_uint32(AF_INET6, link->ifname, "retrans_time_ms", retrans_time_ms, manager_get_sysctl_shadow(link->manager)); } static int link_set_ipv6_proxy_ndp(Link *link) { @@ -497,7 +498,7 @@ static int link_set_ipv6_proxy_ndp(Link *link) { else v = !set_isempty(link->network->ipv6_proxy_ndp_addresses); - return sysctl_write_ip_property_boolean(AF_INET6, link->ifname, "proxy_ndp", v, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_boolean(AF_INET6, link->ifname, "proxy_ndp", v, manager_get_sysctl_shadow(link->manager)); } int link_set_ipv6_mtu(Link *link, int log_level) { @@ -525,7 +526,7 @@ int link_set_ipv6_mtu(Link *link, int log_level) { mtu = link->mtu; } - return sysctl_write_ip_property_uint32(AF_INET6, link->ifname, "mtu", mtu, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_uint32(AF_INET6, link->ifname, "mtu", mtu, manager_get_sysctl_shadow(link->manager)); } static int link_set_ipv4_accept_local(Link *link) { @@ -538,7 +539,7 @@ static int link_set_ipv4_accept_local(Link *link) { if (link->network->ipv4_accept_local < 0) return 0; - return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "accept_local", link->network->ipv4_accept_local > 0, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "accept_local", link->network->ipv4_accept_local > 0, manager_get_sysctl_shadow(link->manager)); } static int link_set_ipv4_route_localnet(Link *link) { @@ -551,7 +552,7 @@ static int link_set_ipv4_route_localnet(Link *link) { if (link->network->ipv4_route_localnet < 0) return 0; - return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "route_localnet", link->network->ipv4_route_localnet > 0, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "route_localnet", link->network->ipv4_route_localnet > 0, manager_get_sysctl_shadow(link->manager)); } static int link_set_ipv4_promote_secondaries(Link *link) { @@ -566,7 +567,7 @@ static int link_set_ipv4_promote_secondaries(Link *link) { * otherwise. The way systemd-networkd works is that the new IP of a lease is added as a * secondary IP and when the primary one expires it relies on the kernel to promote the * secondary IP. See also https://github.com/systemd/systemd/issues/7163 */ - return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "promote_secondaries", true, &link->manager->sysctl_shadow); + return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "promote_secondaries", true, manager_get_sysctl_shadow(link->manager)); } int link_set_sysctl(Link *link) { From 4d6ad22f8d1db2ee42951b40139e498153de0124 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Tue, 17 Sep 2024 15:00:06 +0900 Subject: [PATCH 7/7] network: drop unnecessary BPF related objects from Manager when disabled --- src/network/networkd-manager.c | 2 ++ src/network/networkd-manager.h | 2 ++ 2 files changed, 4 insertions(+) diff --git a/src/network/networkd-manager.c b/src/network/networkd-manager.c index f172e0d865..2813fa1f28 100644 --- a/src/network/networkd-manager.c +++ b/src/network/networkd-manager.c @@ -604,7 +604,9 @@ int manager_new(Manager **ret, bool test_mode) { .duid_product_uuid.type = DUID_TYPE_UUID, .dhcp_server_persist_leases = true, .ip_forwarding = { -1, -1, }, +#if HAVE_VMLINUX_H .cgroup_fd = -EBADF, +#endif }; *ret = TAKE_PTR(m); diff --git a/src/network/networkd-manager.h b/src/network/networkd-manager.h index 9a310c2eab..05a86b6b58 100644 --- a/src/network/networkd-manager.h +++ b/src/network/networkd-manager.h @@ -122,12 +122,14 @@ struct Manager { /* sysctl */ int ip_forwarding[2]; +#if HAVE_VMLINUX_H Hashmap *sysctl_shadow; sd_event_source *sysctl_event_source; struct ring_buffer *sysctl_buffer; struct sysctl_monitor_bpf *sysctl_skel; struct bpf_link *sysctl_link; int cgroup_fd; +#endif }; int manager_new(Manager **ret, bool test_mode);