From 056799e2e147d678e156c5a1fce15b04762f1313 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>

Date: Tue, 1 Sep 2020 23:50:01 +0200

Subject: [PATCH 1/3] core/socket: we may get ENOTCONN from

 socket_instantiate_service()

This means that the connection was aborted before we even got to figure out

what the service name will be. Let's treat this as a non-event and close the

connection fd without any further messages.

Code last changed in 934ef6a5.

Reported-by: Thiago Macieira <thiago.macieira@intel.com>

With the patch:

systemd[1]: foobar.socket: Incoming traffic

systemd[1]: foobar.socket: Got ENOTCONN on incoming socket, assuming aborted connection attempt, ignoring.

...

Also, when we get ENOMEM, don't give the hint about missing unit.

---

 src/core/socket.c | 35 ++++++++++++++++++++++++-----------

 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/src/core/socket.c b/src/core/socket.c

index ebf5ce3b16..f880040331 100644

--- a/src/core/socket.c

+++ b/src/core/socket.c

@@ -18,6 +18,7 @@

 #include "dbus-socket.h"

 #include "dbus-unit.h"

 #include "def.h"

+#include "errno-list.h"

 #include "exit-status.h"

 #include "fd-util.h"

 #include "format-util.h"

@@ -1418,11 +1419,12 @@ int socket_load_service_unit(Socket *s, int cfd, Unit **ret) {

         if (cfd >= 0) {

                 r = instance_from_socket(cfd, s->n_accepted, &instance);

-                if (r == -ENOTCONN)

-                        /* ENOTCONN is legitimate if TCP RST was received.

-                         * This connection is over, but the socket unit lives on. */

+                if (ERRNO_IS_DISCONNECT(r))

+                        /* ENOTCONN is legitimate if TCP RST was received. Other socket families might return

+                         * different errors. This connection is over, but the socket unit lives on. */

                         return log_unit_debug_errno(UNIT(s), r,

-                                                    "Got ENOTCONN on incoming socket, assuming aborted connection attempt, ignoring.");

+                                                    "Got %s on incoming socket, assuming aborted connection attempt, ignoring.",

+                                                    errno_to_name(r));

                 if (r < 0)

                         return r;

         }

@@ -2359,8 +2361,8 @@ static void socket_enter_running(Socket *s, int cfd) {

                 if (!pending) {

                         if (!UNIT_ISSET(s->service)) {

-                                log_unit_error(UNIT(s), "Service to activate vanished, refusing activation.");

-                                r = -ENOENT;

+                                r = log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOENT),

+                                                         "Service to activate vanished, refusing activation.");

                                 goto fail;

                         }

@@ -2382,8 +2384,10 @@ static void socket_enter_running(Socket *s, int cfd) {

                 if (s->max_connections_per_source > 0) {

                         r = socket_acquire_peer(s, cfd, &p);

-                        if (r < 0)

-                                goto refuse;

+                        if (ERRNO_IS_DISCONNECT(r))

+                                goto notconn;

+                        if (r < 0) /* We didn't have enough resources to acquire peer information, let's fail. */

+                                goto fail;

                         if (r > 0 && p->n_ref > s->max_connections_per_source) {

                                 _cleanup_free_ char *t = NULL;

@@ -2397,6 +2401,8 @@ static void socket_enter_running(Socket *s, int cfd) {

                 }

                 r = socket_instantiate_service(s, cfd);

+                if (ERRNO_IS_DISCONNECT(r))

+                        goto notconn;

                 if (r < 0)

                         goto fail;

@@ -2406,6 +2412,8 @@ static void socket_enter_running(Socket *s, int cfd) {

                 s->n_accepted++;

                 r = service_set_socket_fd(service, cfd, s, s->selinux_context_from_net);

+                if (ERRNO_IS_DISCONNECT(r))

+                        goto notconn;

                 if (r < 0)

                         goto fail;

@@ -2430,13 +2438,18 @@ static void socket_enter_running(Socket *s, int cfd) {

 refuse:

         s->n_refused++;

+notconn:

         safe_close(cfd);

         return;

 fail:

-        log_unit_warning(UNIT(s), "Failed to queue service startup job (Maybe the service file is missing or not a %s unit?): %s",

-                         cfd >= 0 ? "template" : "non-template",

-                         bus_error_message(&error, r));

+        if (ERRNO_IS_RESOURCE(r))

+                log_unit_warning(UNIT(s), "Failed to queue service startup job: %s",

+                                 bus_error_message(&error, r));

+        else

+                log_unit_warning(UNIT(s), "Failed to queue service startup job (Maybe the service file is missing or not a %s unit?): %s",

+                                 cfd >= 0 ? "template" : "non-template",

+                                 bus_error_message(&error, r));

         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);

         safe_close(cfd);

-- 

2.26.2

From 86f9af3eb8bea0bea86bb027cb341e6b13beecb5 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>

Date: Wed, 2 Sep 2020 18:04:10 +0200

Subject: [PATCH 2/3] core/socket: fold socket_instantiate_service() into

 socket_enter_running()

socket_instantiate_service() was doing unit_ref_set(), and the caller was

immediately doing unit_ref_unset(). After we get rid of this, it doesn't seem

worth it to have two functions.

---

 src/core/socket.c | 39 ++++++++++-----------------------------

 1 file changed, 10 insertions(+), 29 deletions(-)

diff --git a/src/core/socket.c b/src/core/socket.c

index f880040331..5e128d9fef 100644

--- a/src/core/socket.c

+++ b/src/core/socket.c

@@ -206,27 +206,6 @@ static int socket_arm_timer(Socket *s, usec_t usec) {

         return 0;

 }

-static int socket_instantiate_service(Socket *s, int cfd) {

-        Unit *service;

-        int r;

-

-        assert(s);

-        assert(cfd >= 0);

-

-        /* This fills in s->service if it isn't filled in yet. For Accept=yes sockets we create the next

-         * connection service here. For Accept=no this is mostly a NOP since the service is figured out at

-         * load time anyway. */

-

-        r = socket_load_service_unit(s, cfd, &service);

-        if (r < 0)

-                return r;

-

-        unit_ref_set(&s->service, UNIT(s), service);

-

-        return unit_add_two_dependencies(UNIT(s), UNIT_BEFORE, UNIT_TRIGGERS, service,

-                                         false, UNIT_DEPENDENCY_IMPLICIT);

-}

-

 static bool have_non_accept_socket(Socket *s) {

         SocketPort *p;

@@ -2374,7 +2353,7 @@ static void socket_enter_running(Socket *s, int cfd) {

                 socket_set_state(s, SOCKET_RUNNING);

         } else {

                 _cleanup_(socket_peer_unrefp) SocketPeer *p = NULL;

-                Service *service;

+                Unit *service;

                 if (s->n_connections >= s->max_connections) {

                         log_unit_warning(UNIT(s), "Too many incoming connections (%u), dropping connection.",

@@ -2400,18 +2379,20 @@ static void socket_enter_running(Socket *s, int cfd) {

                         }

                 }

-                r = socket_instantiate_service(s, cfd);

+                r = socket_load_service_unit(s, cfd, &service);

                 if (ERRNO_IS_DISCONNECT(r))

                         goto notconn;

                 if (r < 0)

                         goto fail;

-                service = SERVICE(UNIT_DEREF(s->service));

-                unit_ref_unset(&s->service);

+                r = unit_add_two_dependencies(UNIT(s), UNIT_BEFORE, UNIT_TRIGGERS, service,

+                                              false, UNIT_DEPENDENCY_IMPLICIT);

+                if (r < 0)

+                        goto fail;

                 s->n_accepted++;

-                r = service_set_socket_fd(service, cfd, s, s->selinux_context_from_net);

+                r = service_set_socket_fd(SERVICE(service), cfd, s, s->selinux_context_from_net);

                 if (ERRNO_IS_DISCONNECT(r))

                         goto notconn;

                 if (r < 0)

@@ -2420,13 +2401,13 @@ static void socket_enter_running(Socket *s, int cfd) {

                 TAKE_FD(cfd); /* We passed ownership of the fd to the service now. Forget it here. */

                 s->n_connections++;

-                service->peer = TAKE_PTR(p); /* Pass ownership of the peer reference */

+                SERVICE(service)->peer = TAKE_PTR(p); /* Pass ownership of the peer reference */

-                r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT(service), JOB_REPLACE, NULL, &error, NULL);

+                r = manager_add_job(UNIT(s)->manager, JOB_START, service, JOB_REPLACE, NULL, &error, NULL);

                 if (r < 0) {

                         /* We failed to activate the new service, but it still exists. Let's make sure the

                          * service closes and forgets the connection fd again, immediately. */

-                        service_close_socket_fd(service);

+                        service_close_socket_fd(SERVICE(service));

                         goto fail;

                 }

-- 

2.26.2

From b7e9403a4c6220478980555ef40905d030b307f5 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>

Date: Wed, 2 Sep 2020 18:17:14 +0200

Subject: [PATCH 3/3] core/socket: use _cleanup_ to close the connection fd

Removing the gotos would lead to a lot of duplicated code, so I left them

as they were.

---

 src/core/socket.c | 22 ++++++++++------------

 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/src/core/socket.c b/src/core/socket.c

index 5e128d9fef..a77a297cf5 100644

--- a/src/core/socket.c

+++ b/src/core/socket.c

@@ -2296,13 +2296,14 @@ static void flush_ports(Socket *s) {

         }

 }

-static void socket_enter_running(Socket *s, int cfd) {

+static void socket_enter_running(Socket *s, int cfd_in) {

+        /* Note that this call takes possession of the connection fd passed. It either has to assign it

+         * somewhere or close it. */

+        _cleanup_close_ int cfd = cfd_in;

+

         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;

         int r;

-        /* Note that this call takes possession of the connection fd passed. It either has to assign it somewhere or

-         * close it. */

-

         assert(s);

         /* We don't take connections anymore if we are supposed to shut down anyway */

@@ -2312,9 +2313,8 @@ static void socket_enter_running(Socket *s, int cfd) {

                 if (cfd >= 0)

                         goto refuse;

-                else

-                        flush_ports(s);

+                flush_ports(s);

                 return;

         }

@@ -2364,7 +2364,7 @@ static void socket_enter_running(Socket *s, int cfd) {

                 if (s->max_connections_per_source > 0) {

                         r = socket_acquire_peer(s, cfd, &p);

                         if (ERRNO_IS_DISCONNECT(r))

-                                goto notconn;

+                                return;

                         if (r < 0) /* We didn't have enough resources to acquire peer information, let's fail. */

                                 goto fail;

                         if (r > 0 && p->n_ref > s->max_connections_per_source) {

@@ -2381,7 +2381,7 @@ static void socket_enter_running(Socket *s, int cfd) {

                 r = socket_load_service_unit(s, cfd, &service);

                 if (ERRNO_IS_DISCONNECT(r))

-                        goto notconn;

+                        return;

                 if (r < 0)

                         goto fail;

@@ -2394,7 +2394,7 @@ static void socket_enter_running(Socket *s, int cfd) {

                 r = service_set_socket_fd(SERVICE(service), cfd, s, s->selinux_context_from_net);

                 if (ERRNO_IS_DISCONNECT(r))

-                        goto notconn;

+                        return;

                 if (r < 0)

                         goto fail;

@@ -2415,12 +2415,11 @@ static void socket_enter_running(Socket *s, int cfd) {

                 unit_add_to_dbus_queue(UNIT(s));

         }

+        TAKE_FD(cfd);

         return;

 refuse:

         s->n_refused++;

-notconn:

-        safe_close(cfd);

         return;

 fail:

@@ -2433,7 +2432,6 @@ fail:

                                  bus_error_message(&error, r));

         socket_enter_stop_pre(s, SOCKET_FAILURE_RESOURCES);

-        safe_close(cfd);

 }

 static void socket_run_next(Socket *s) {

-- 

2.26.2