wireless: fix use-after-free bug
[project/netifd.git] / proto-shell.c
index 038fb0b..6bbfe10 100644 (file)
 #include <string.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <glob.h>
-#include <unistd.h>
-#include <fcntl.h>
 #include <signal.h>
 
 #include <arpa/inet.h>
 #include <netinet/in.h>
 
-#include <libubox/blobmsg_json.h>
 
 #include "netifd.h"
 #include "interface.h"
 #include "interface-ip.h"
 #include "proto.h"
 #include "system.h"
+#include "handler.h"
 
 static int proto_fd = -1;
 
@@ -44,15 +41,17 @@ enum proto_shell_sm {
 struct proto_shell_handler {
        struct list_head list;
        struct proto_handler proto;
-       struct config_param_list config;
        char *config_buf;
+       char *script_name;
        bool init_available;
-       char script_name[];
+
+       struct uci_blob_param_list config;
 };
 
 struct proto_shell_dependency {
        struct list_head list;
 
+       char *interface;
        struct proto_shell_state *proto;
        struct interface_user dep;
 
@@ -105,12 +104,15 @@ proto_shell_if_down_cb(struct interface_user *dep, struct interface *iface,
 static void
 proto_shell_update_host_dep(struct proto_shell_dependency *dep)
 {
-       struct interface *iface;
+       struct interface *iface = NULL;
 
        if (dep->dep.iface)
                goto out;
 
-       iface = interface_ip_add_target_route(&dep->host, dep->v6);
+       if (dep->interface[0])
+               iface = vlist_find(&interfaces, dep->interface, iface, node);
+
+       iface = interface_ip_add_target_route(&dep->host, dep->v6, iface);
        if (!iface)
                goto out;
 
@@ -206,7 +208,7 @@ proto_shell_if_up_cb(struct interface_user *dep, struct interface *iface,
 {
        struct proto_shell_dependency *pdep;
 
-       if (ev != IFEV_UP)
+       if (ev != IFEV_UP && ev != IFEV_UPDATE)
                return;
 
        pdep = container_of(dep, struct proto_shell_dependency, dep);
@@ -220,7 +222,7 @@ proto_shell_if_down_cb(struct interface_user *dep, struct interface *iface,
        struct proto_shell_dependency *pdep;
        struct proto_shell_state *state;
 
-       if (ev == IFEV_UP)
+       if (ev == IFEV_UP || ev == IFEV_UPDATE)
                return;
 
        pdep = container_of(dep, struct proto_shell_dependency, dep);
@@ -616,17 +618,26 @@ proto_shell_add_host_dependency(struct proto_shell_state *state, struct blob_att
 {
        struct proto_shell_dependency *dep;
        struct blob_attr *host = tb[NOTIFY_HOST];
+       struct blob_attr *ifname_a = tb[NOTIFY_IFNAME];
+       const char *ifname_str = ifname_a ? blobmsg_data(ifname_a) : "";
+       char *ifname;
 
        if (!host)
                return UBUS_STATUS_INVALID_ARGUMENT;
 
-       dep = calloc(1, sizeof(*dep));
-       if (!inet_pton(AF_INET, blobmsg_data(host), &dep->host)) {
-               free(dep);
-               return UBUS_STATUS_INVALID_ARGUMENT;
+       dep = calloc_a(sizeof(*dep), &ifname, strlen(ifname_str) + 1);
+       if (inet_pton(AF_INET, blobmsg_data(host), &dep->host) < 1) {
+               if (inet_pton(AF_INET6, blobmsg_data(host), &dep->host) < 1) {
+                       free(dep);
+                       return UBUS_STATUS_INVALID_ARGUMENT;
+               } else {
+                       dep->v6 = true;
+               }
        }
 
        dep->proto = state;
+       dep->interface = strcpy(ifname, ifname_str);
+
        dep->dep.cb = proto_shell_if_up_cb;
        interface_add_user(&dep->dep, NULL);
        list_add(&dep->list, &state->deps);
@@ -720,205 +731,48 @@ error:
        return NULL;
 }
 
-static json_object *
-check_type(json_object *obj, json_type type)
-{
-       if (!obj)
-               return NULL;
-
-       if (json_object_get_type(obj) != type)
-               return NULL;
-
-       return obj;
-}
-
-static inline json_object *
-get_field(json_object *obj, const char *name, json_type type)
-{
-       return check_type(json_object_object_get(obj, name), type);
-}
-
-static char *
-proto_shell_parse_config(struct config_param_list *config, json_object *obj)
-{
-       struct blobmsg_policy *attrs;
-       char *str_buf, *str_cur;
-       int str_len = 0;
-       int i;
-
-       config->n_params = json_object_array_length(obj);
-       attrs = calloc(1, sizeof(*attrs) * config->n_params);
-       if (!attrs)
-               return NULL;
-
-       config->params = attrs;
-       for (i = 0; i < config->n_params; i++) {
-               json_object *cur, *name, *type;
-
-               cur = check_type(json_object_array_get_idx(obj, i), json_type_array);
-               if (!cur)
-                       goto error;
-
-               name = check_type(json_object_array_get_idx(cur, 0), json_type_string);
-               if (!name)
-                       goto error;
-
-               type = check_type(json_object_array_get_idx(cur, 1), json_type_int);
-               if (!type)
-                       goto error;
-
-               attrs[i].name = json_object_get_string(name);
-               attrs[i].type = json_object_get_int(type);
-               if (attrs[i].type > BLOBMSG_TYPE_LAST)
-                       goto error;
-
-               str_len += strlen(attrs[i].name) + 1;
-       }
-
-       str_buf = malloc(str_len);
-       if (!str_buf)
-               goto error;
-
-       str_cur = str_buf;
-       for (i = 0; i < config->n_params; i++) {
-               const char *name = attrs[i].name;
-
-               attrs[i].name = str_cur;
-               str_cur += sprintf(str_cur, "%s", name) + 1;
-       }
-
-       return str_buf;
-
-error:
-       free(attrs);
-       config->n_params = 0;
-       return NULL;
-}
-
 static void
-proto_shell_add_handler(const char *script, json_object *obj)
+proto_shell_add_handler(const char *script, const char *name, json_object *obj)
 {
        struct proto_shell_handler *handler;
        struct proto_handler *proto;
        json_object *config, *tmp;
-       const char *name;
-       char *str;
-
-       if (!check_type(obj, json_type_object))
-               return;
-
-       tmp = get_field(obj, "name", json_type_string);
-       if (!tmp)
-               return;
-
-       name = json_object_get_string(tmp);
+       char *proto_name, *script_name;
 
-       handler = calloc(1, sizeof(*handler) +
-                        strlen(script) + 1 +
-                        strlen(name) + 1);
+       handler = calloc_a(sizeof(*handler),
+                          &proto_name, strlen(name) + 1,
+                          &script_name, strlen(script) + 1);
        if (!handler)
                return;
 
-       strcpy(handler->script_name, script);
-
-       str = handler->script_name + strlen(handler->script_name) + 1;
-       strcpy(str, name);
+       handler->script_name = strcpy(script_name, script);
 
        proto = &handler->proto;
-       proto->name = str;
+       proto->name = strcpy(proto_name, name);
        proto->config_params = &handler->config;
        proto->attach = proto_shell_attach;
 
-       tmp = get_field(obj, "no-device", json_type_boolean);
+       tmp = json_get_field(obj, "no-device", json_type_boolean);
        if (tmp && json_object_get_boolean(tmp))
                handler->proto.flags |= PROTO_FLAG_NODEV;
 
-       tmp = get_field(obj, "available", json_type_boolean);
+       tmp = json_get_field(obj, "available", json_type_boolean);
        if (tmp && json_object_get_boolean(tmp))
                handler->proto.flags |= PROTO_FLAG_INIT_AVAILABLE;
 
-       config = get_field(obj, "config", json_type_array);
+       config = json_get_field(obj, "config", json_type_array);
        if (config)
-               handler->config_buf = proto_shell_parse_config(&handler->config, config);
+               handler->config_buf = netifd_handler_parse_config(&handler->config, config);
 
        DPRINTF("Add handler for script %s: %s\n", script, proto->name);
        add_proto_handler(proto);
 }
 
-static void proto_shell_add_script(const char *name)
-{
-       struct json_tokener *tok = NULL;
-       json_object *obj;
-       static char buf[512];
-       char *start, *cmd;
-       FILE *f;
-       int len;
-
-#define DUMP_SUFFIX    " '' dump"
-
-       cmd = alloca(strlen(name) + 1 + sizeof(DUMP_SUFFIX));
-       sprintf(cmd, "%s" DUMP_SUFFIX, name);
-
-       f = popen(cmd, "r");
-       if (!f)
-               return;
-
-       do {
-               start = fgets(buf, sizeof(buf), f);
-               if (!start)
-                       continue;
-
-               len = strlen(start);
-
-               if (!tok)
-                       tok = json_tokener_new();
-
-               obj = json_tokener_parse_ex(tok, start, len);
-               if (!is_error(obj)) {
-                       proto_shell_add_handler(name, obj);
-                       json_object_put(obj);
-                       json_tokener_free(tok);
-                       tok = NULL;
-               } else if (start[len - 1] == '\n') {
-                       json_tokener_free(tok);
-                       tok = NULL;
-               }
-       } while (!feof(f) && !ferror(f));
-
-       if (tok)
-               json_tokener_free(tok);
-
-       pclose(f);
-}
-
 static void __init proto_shell_init(void)
 {
-       glob_t g;
-       int main_fd;
-       int i;
-
-       main_fd = open(".", O_RDONLY | O_DIRECTORY);
-       if (main_fd < 0)
-               return;
-
-       if (chdir(main_path)) {
-               perror("chdir(main path)");
-               goto close_cur;
-       }
-
-       if (chdir("./proto"))
-               goto close_cur;
-
-       proto_fd = open(".", O_RDONLY | O_DIRECTORY);
+       proto_fd = netifd_open_subdir("proto");
        if (proto_fd < 0)
-               goto close_cur;
-
-       system_fd_set_cloexec(proto_fd);
-       glob("./*.sh", 0, NULL, &g);
-       for (i = 0; i < g.gl_pathc; i++)
-               proto_shell_add_script(g.gl_pathv[i]);
+               return;
 
-close_cur:
-       fchdir(main_fd);
-       close(main_fd);
+       netifd_init_script_handlers(proto_fd, proto_shell_add_handler);
 }