commit f30a54b21b83f254533c59ca72ad17af5249c6be
Author: Florian Weimer <fweimer@redhat.com>
Date: Mon Jul 3 20:31:23 2017 +0200
resolv: Introduce struct resolv_conf with extended resolver state
This change provides additional resolver configuration state which
is not exposed through the _res ABI. It reuses the existing
initstamp field in the supposedly-private part of _res. Some effort
is undertaken to avoid memory safety issues introduced by applications
which directly patch the _res object.
With this commit, only the initstamp field is moved into struct
resolv_conf. Additional members will be added later, eventually
migrating the entire resolver configuration.
diff --git a/resolv/Makefile b/resolv/Makefile
index 7f5e07d618297f60..ef5ed2966e4d6c51 100644
--- a/resolv/Makefile
+++ b/resolv/Makefile
@@ -29,7 +29,7 @@ headers := resolv.h \
routines := herror inet_addr inet_ntop inet_pton nsap_addr res_init \
res_hconf res_libc res-state res_randomid res-close \
- resolv_context
+ resolv_context resolv_conf
tests = tst-aton tst-leaks tst-inet_ntop
xtests = tst-leaks2
diff --git a/resolv/res-close.c b/resolv/res-close.c
index 97da73c99cfd0e12..21f038c2c77f7375 100644
--- a/resolv/res-close.c
+++ b/resolv/res-close.c
@@ -84,6 +84,7 @@
#include <resolv-internal.h>
#include <resolv_context.h>
+#include <resolv_conf.h>
#include <not-cancel.h>
/* Close all open sockets. If FREE_ADDR is true, deallocate any
@@ -111,6 +112,8 @@ __res_iclose (res_state statp, bool free_addr)
statp->_u._ext.nsaddrs[ns] = NULL;
}
}
+ if (free_addr)
+ __resolv_conf_detach (statp);
}
libc_hidden_def (__res_iclose)
diff --git a/resolv/res_init.c b/resolv/res_init.c
index 5d8b2c994d8e6f04..659d3ea81f973257 100644
--- a/resolv/res_init.c
+++ b/resolv/res_init.c
@@ -102,6 +102,7 @@
#include <sys/types.h>
#include <inet/net-internal.h>
#include <errno.h>
+#include <resolv_conf.h>
static void res_setoptions (res_state, const char *);
static uint32_t net_mask (struct in_addr);
@@ -137,7 +138,6 @@ res_vinit_1 (res_state statp, bool preinit, FILE *fp, char **buffer)
bool havesearch = false;
int nsort = 0;
char *net;
- statp->_u._ext.initstamp = __res_initstamp;
if (!preinit)
{
@@ -457,6 +457,19 @@ __res_vinit (res_state statp, int preinit)
bool ok = res_vinit_1 (statp, preinit, fp, &buffer);
free (buffer);
+ if (ok)
+ {
+ struct resolv_conf init = { 0 }; /* No data yet. */
+ struct resolv_conf *conf = __resolv_conf_allocate (&init);
+ if (conf == NULL)
+ ok = false;
+ else
+ {
+ ok = __resolv_conf_attach (statp, conf);
+ __resolv_conf_put (conf);
+ }
+ }
+
if (!ok)
{
/* Deallocate the name server addresses which have been
diff --git a/resolv/resolv.h b/resolv/resolv.h
index 9fef8e9f248c84e6..b83232cca8e8f0c3 100644
--- a/resolv/resolv.h
+++ b/resolv/resolv.h
@@ -122,10 +122,10 @@ struct __res_state {
uint16_t nsinit;
struct sockaddr_in6 *nsaddrs[MAXNS];
#ifdef _LIBC
- unsigned long long int initstamp
+ unsigned long long int __glibc_extension_index
__attribute__((packed));
#else
- unsigned int _initstamp[2];
+ unsigned int __glibc_reserved[2];
#endif
} _ext;
} _u;
diff --git a/resolv/resolv_conf.c b/resolv/resolv_conf.c
new file mode 100644
index 0000000000000000..cabe69cf1ba3f4d5
--- /dev/null
+++ b/resolv/resolv_conf.c
@@ -0,0 +1,322 @@
+/* Extended resolver state separate from struct __res_state.
+ Copyright (C) 2017 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+#include <resolv_conf.h>
+
+#include <alloc_buffer.h>
+#include <assert.h>
+#include <libc-lock.h>
+#include <resolv-internal.h>
+
+/* _res._u._ext.__glibc_extension_index is used as an index into a
+ struct resolv_conf_array object. The intent of this construction
+ is to make reasonably sure that even if struct __res_state objects
+ are copied around and patched by applications, we can still detect
+ accesses to stale extended resolver state. */
+#define DYNARRAY_STRUCT resolv_conf_array
+#define DYNARRAY_ELEMENT struct resolv_conf *
+#define DYNARRAY_PREFIX resolv_conf_array_
+#define DYNARRAY_INITIAL_SIZE 0
+#include <malloc/dynarray-skeleton.c>
+
+/* A magic constant for XORing the extension index
+ (_res._u._ext.__glibc_extension_index). This makes it less likely
+ that a valid index is created by accident. In particular, a zero
+ value leads to an invalid index. */
+#define INDEX_MAGIC 0x26a8fa5e48af8061ULL
+
+/* Global resolv.conf-related state. */
+struct resolv_conf_global
+{
+ /* struct __res_state objects contain the extension index
+ (_res._u._ext.__glibc_extension_index ^ INDEX_MAGIC), which
+ refers to an element of this array. When a struct resolv_conf
+ object (extended resolver state) is associated with a struct
+ __res_state object (legacy resolver state), its reference count
+ is increased and added to this array. Conversely, if the
+ extended state is detached from the basic state (during
+ reinitialization or deallocation), the index is decremented, and
+ the array element is overwritten with NULL. */
+ struct resolv_conf_array array;
+
+};
+
+/* Lazily allocated storage for struct resolv_conf_global. */
+static struct resolv_conf_global *global;
+
+/* The lock synchronizes access to global and *global. It also
+ protects the __refcount member of struct resolv_conf. */
+__libc_lock_define_initialized (static, lock);
+
+/* Ensure that GLOBAL is allocated and lock it. Return NULL if
+ memory allocation failes. */
+static struct resolv_conf_global *
+get_locked_global (void)
+{
+ __libc_lock_lock (lock);
+ /* Use relaxed MO through because of load outside the lock in
+ __resolv_conf_detach. */
+ struct resolv_conf_global *global_copy = atomic_load_relaxed (&global);
+ if (global_copy == NULL)
+ {
+ global_copy = calloc (1, sizeof (*global));
+ if (global_copy == NULL)
+ return NULL;
+ atomic_store_relaxed (&global, global_copy);
+ resolv_conf_array_init (&global_copy->array);
+ }
+ return global_copy;
+}
+
+/* Relinquish the lock acquired by get_locked_global. */
+static void
+put_locked_global (struct resolv_conf_global *global_copy)
+{
+ __libc_lock_unlock (lock);
+}
+
+/* Decrement the reference counter. The caller must acquire the lock
+ around the function call. */
+static void
+conf_decrement (struct resolv_conf *conf)
+{
+ assert (conf->__refcount > 0);
+ if (--conf->__refcount == 0)
+ free (conf);
+}
+
+/* Internal implementation of __resolv_conf_get, without validation
+ against *RESP. */
+static struct resolv_conf *
+resolv_conf_get_1 (const struct __res_state *resp)
+{
+ /* Not initialized, and therefore no assoicated context. */
+ if (!(resp->options & RES_INIT))
+ return NULL;
+
+ struct resolv_conf_global *global_copy = get_locked_global ();
+ if (global_copy == NULL)
+ /* A memory allocation failure here means that no associated
+ contexts exists, so returning NULL is correct. */
+ return NULL;
+ size_t index = resp->_u._ext.__glibc_extension_index ^ INDEX_MAGIC;
+ struct resolv_conf *conf;
+ if (index < resolv_conf_array_size (&global_copy->array))
+ {
+ conf = *resolv_conf_array_at (&global_copy->array, index);
+ assert (conf->__refcount > 0);
+ ++conf->__refcount;
+ }
+ else
+ conf = NULL;
+ put_locked_global (global_copy);
+ return conf;
+}
+
+/* Check that *RESP and CONF match. Used by __resolv_conf_get. */
+static bool
+resolv_conf_matches (const struct __res_state *resp,
+ const struct resolv_conf *conf)
+{
+ return true;
+}
+
+struct resolv_conf *
+__resolv_conf_get (struct __res_state *resp)
+{
+ struct resolv_conf *conf = resolv_conf_get_1 (resp);
+ if (conf == NULL)
+ return NULL;
+ if (resolv_conf_matches (resp, conf))
+ return conf;
+ __resolv_conf_put (conf);
+ return NULL;
+}
+
+void
+__resolv_conf_put (struct resolv_conf *conf)
+{
+ if (conf == NULL)
+ return;
+
+ __libc_lock_lock (lock);
+ conf_decrement (conf);
+ __libc_lock_unlock (lock);
+}
+
+struct resolv_conf *
+__resolv_conf_allocate (const struct resolv_conf *init)
+{
+ /* Allocate the buffer. */
+ void *ptr;
+ struct alloc_buffer buffer = alloc_buffer_allocate
+ (sizeof (struct resolv_conf),
+ &ptr);
+ struct resolv_conf *conf
+ = alloc_buffer_alloc (&buffer, struct resolv_conf);
+ if (conf == NULL)
+ /* Memory allocation failure. */
+ return NULL;
+ assert (conf == ptr);
+
+ /* Initialize the contents. */
+ conf->__refcount = 1;
+ conf->initstamp = __res_initstamp;
+
+ assert (!alloc_buffer_has_failed (&buffer));
+ return conf;
+}
+
+/* Update *RESP from the extended state. */
+static __attribute__ ((nonnull (1, 2), warn_unused_result)) bool
+update_from_conf (struct __res_state *resp, const struct resolv_conf *conf)
+{
+ /* The overlapping parts of both configurations should agree after
+ initialization. */
+ assert (resolv_conf_matches (resp, conf));
+ return true;
+}
+
+/* Decrement the configuration object at INDEX and free it if the
+ reference counter reaches 0. *GLOBAL_COPY must be locked and
+ remains so. */
+static void
+decrement_at_index (struct resolv_conf_global *global_copy, size_t index)
+{
+ if (index < resolv_conf_array_size (&global_copy->array))
+ {
+ /* Index found. Deallocate the struct resolv_conf object once
+ the reference counter reaches. Free the array slot. */
+ struct resolv_conf **slot
+ = resolv_conf_array_at (&global_copy->array, index);
+ struct resolv_conf *conf = *slot;
+ if (conf != NULL)
+ {
+ conf_decrement (conf);
+ /* Clear the slot even if the reference count is positive.
+ Slots are not shared. */
+ *slot = NULL;
+ }
+ }
+}
+
+bool
+__resolv_conf_attach (struct __res_state *resp, struct resolv_conf *conf)
+{
+ assert (conf->__refcount > 0);
+
+ struct resolv_conf_global *global_copy = get_locked_global ();
+ if (global_copy == NULL)
+ {
+ free (conf);
+ return false;
+ }
+
+ /* Try to find an unused index in the array. */
+ size_t index;
+ {
+ size_t size = resolv_conf_array_size (&global_copy->array);
+ bool found = false;
+ for (index = 0; index < size; ++index)
+ {
+ struct resolv_conf **p
+ = resolv_conf_array_at (&global_copy->array, index);
+ if (*p == NULL)
+ {
+ *p = conf;
+ found = true;
+ break;
+ }
+ }
+
+ if (!found)
+ {
+ /* No usable index found. Increase the array size. */
+ resolv_conf_array_add (&global_copy->array, conf);
+ if (resolv_conf_array_has_failed (&global_copy->array))
+ {
+ put_locked_global (global_copy);
+ __set_errno (ENOMEM);
+ return false;
+ }
+ /* The new array element was added at the end. */
+ index = size;
+ }
+ }
+
+ /* We have added a new reference to the object. */
+ ++conf->__refcount;
+ assert (conf->__refcount > 0);
+ put_locked_global (global_copy);
+
+ if (!update_from_conf (resp, conf))
+ {
+ /* Drop the reference we acquired. Reacquire the lock. The
+ object has already been allocated, so it cannot be NULL this
+ time. */
+ global_copy = get_locked_global ();
+ decrement_at_index (global_copy, index);
+ put_locked_global (global_copy);
+ return false;
+ }
+ resp->_u._ext.__glibc_extension_index = index ^ INDEX_MAGIC;
+
+ return true;
+}
+
+void
+__resolv_conf_detach (struct __res_state *resp)
+{
+ if (atomic_load_relaxed (&global) == NULL)
+ /* Detach operation after a shutdown, or without any prior
+ attachment. We cannot free the data (and there might not be
+ anything to free anyway). */
+ return;
+
+ struct resolv_conf_global *global_copy = get_locked_global ();
+ size_t index = resp->_u._ext.__glibc_extension_index ^ INDEX_MAGIC;
+ decrement_at_index (global_copy, index);
+
+ /* Clear the index field, so that accidental reuse is less
+ likely. */
+ resp->_u._ext.__glibc_extension_index = 0;
+
+ put_locked_global (global_copy);
+}
+
+/* Deallocate the global data. */
+static void __attribute__ ((section ("__libc_thread_freeres_fn")))
+freeres (void)
+{
+ /* No locking because this function is supposed to be called when
+ the process has turned single-threaded. */
+ if (global == NULL)
+ return;
+
+ /* Note that this frees only the array itself. The pointed-to
+ configuration objects should have been deallocated by res_nclose
+ and per-thread cleanup functions. */
+ resolv_conf_array_free (&global->array);
+
+ free (global);
+
+ /* Stop potential future __resolv_conf_detach calls from accessing
+ deallocated memory. */
+ global = NULL;
+}
+text_set_element (__libc_subfreeres, freeres);
diff --git a/resolv/resolv_conf.h b/resolv/resolv_conf.h
new file mode 100644
index 0000000000000000..48f92d6d5753aef1
--- /dev/null
+++ b/resolv/resolv_conf.h
@@ -0,0 +1,69 @@
+/* Extended resolver state separate from struct __res_state.
+ Copyright (C) 2017 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+#ifndef RESOLV_STATE_H
+#define RESOLV_STATE_H
+
+#include <stdbool.h>
+#include <stddef.h>
+
+/* Extended resolver state associated with res_state objects. Client
+ code can reach this state through a struct resolv_context
+ object. */
+struct resolv_conf
+{
+ /* Used to propagate the effect of res_init across threads. This
+ member is mutable and prevents sharing of the same struct
+ resolv_conf object among multiple struct __res_state objects. */
+ unsigned long long int initstamp;
+
+ /* Reference counter. The object is deallocated once it reaches
+ zero. For internal use within resolv_conf only. */
+ size_t __refcount;
+};
+
+/* The functions below are for use by the res_init resolv.conf parser
+ and the struct resolv_context facility. */
+
+struct __res_state;
+
+/* Return the extended resolver state for *RESP, or NULL if it cannot
+ be determined. A call to this function must be paired with a call
+ to __resolv_conf_put. */
+struct resolv_conf *__resolv_conf_get (struct __res_state *) attribute_hidden;
+
+/* Converse of __resolv_conf_get. */
+void __resolv_conf_put (struct resolv_conf *) attribute_hidden;
+
+/* Allocate a new struct resolv_conf object and copy the
+ pre-configured values from *INIT. Return NULL on allocation
+ failure. The object must be deallocated using
+ __resolv_conf_put. */
+struct resolv_conf *__resolv_conf_allocate (const struct resolv_conf *init)
+ attribute_hidden __attribute__ ((nonnull (1), warn_unused_result));
+
+/* Associate an existing extended resolver state with *RESP. Return
+ false on allocation failure. In addition, update *RESP with the
+ overlapping non-extended resolver state. */
+bool __resolv_conf_attach (struct __res_state *, struct resolv_conf *)
+ attribute_hidden;
+
+/* Detach the extended resolver state from *RESP. */
+void __resolv_conf_detach (struct __res_state *resp) attribute_hidden;
+
+#endif /* RESOLV_STATE_H */
diff --git a/resolv/resolv_context.c b/resolv/resolv_context.c
index 5083a40419bc463c..0ee2184055911d02 100644
--- a/resolv/resolv_context.c
+++ b/resolv/resolv_context.c
@@ -17,9 +17,11 @@
<http://www.gnu.org/licenses/>. */
#include <resolv_context.h>
+#include <resolv_conf.h>
#include <resolv-internal.h>
#include <assert.h>
+#include <errno.h>
#include <stdlib.h>
#include <stdio.h>
@@ -52,19 +54,37 @@ static __thread struct resolv_context *current attribute_tls_model_ie;
/* Initialize *RESP if RES_INIT is not yet set in RESP->options, or if
res_init in some other thread requested re-initializing. */
static __attribute__ ((warn_unused_result)) bool
-maybe_init (struct __res_state *resp, bool preinit)
+maybe_init (struct resolv_context *ctx, bool preinit)
{
+ struct __res_state *resp = ctx->resp;
if (resp->options & RES_INIT)
{
- if (__res_initstamp != resp->_u._ext.initstamp)
+ /* If there is no associated resolv_conf object despite the
+ initialization, something modified *ctx->resp. Do not
+ override those changes. */
+ if (ctx->conf != NULL && ctx->conf->initstamp != __res_initstamp)
{
if (resp->nscount > 0)
+ /* This call will detach the extended resolver state. */
__res_iclose (resp, true);
- return __res_vinit (resp, 1) == 0;
+ /* And this call will attach it again. */
+ if (__res_vinit (resp, 1) < 0)
+ {
+ /* The configuration no longer matches after failed
+ initialization. */
+ __resolv_conf_put (ctx->conf);
+ ctx->conf = NULL;
+ return false;
+ }
+ /* Delay the release of the old configuration until this
+ point, so that __res_vinit can reuse it if possible. */
+ __resolv_conf_put (ctx->conf);
+ ctx->conf = __resolv_conf_get (ctx->resp);
}
return true;
}
+ assert (ctx->conf == NULL);
if (preinit)
{
if (!resp->retrans)
@@ -75,7 +95,11 @@ maybe_init (struct __res_state *resp, bool preinit)
if (!resp->id)
resp->id = res_randomid ();
}
- return __res_vinit (resp, preinit) == 0;
+
+ if (__res_vinit (resp, preinit) < 0)
+ return false;
+ ctx->conf = __resolv_conf_get (ctx->resp);
+ return true;
}
/* Allocate a new context object and initialize it. The object is put
@@ -87,6 +111,7 @@ context_alloc (struct __res_state *resp)
if (ctx == NULL)
return NULL;
ctx->resp = resp;
+ ctx->conf = __resolv_conf_get (resp);
ctx->__refcount = 1;
ctx->__from_res = true;
ctx->__next = current;
@@ -98,8 +123,11 @@ context_alloc (struct __res_state *resp)
static void
context_free (struct resolv_context *ctx)
{
+ int error_code = errno;
current = ctx->__next;
+ __resolv_conf_put (ctx->conf);
free (ctx);
+ __set_errno (error_code);
}
/* Reuse the current context object. */
@@ -130,7 +158,7 @@ context_get (bool preinit)
struct resolv_context *ctx = context_alloc (&_res);
if (ctx == NULL)
return NULL;
- if (!maybe_init (ctx->resp, preinit))
+ if (!maybe_init (ctx, preinit))
{
context_free (ctx);
return NULL;
diff --git a/resolv/resolv_context.h b/resolv/resolv_context.h
index 27c8d56b36104521..ff9ef2c7fe6101f3 100644
--- a/resolv/resolv_context.h
+++ b/resolv/resolv_context.h
@@ -40,15 +40,22 @@
#ifndef _RESOLV_CONTEXT_H
#define _RESOLV_CONTEXT_H
+#include <bits/types/res_state.h>
+#include <resolv/resolv_conf.h>
#include <stdbool.h>
#include <stddef.h>
-#include <bits/types/res_state.h>
/* Temporary resolver state. */
struct resolv_context
{
struct __res_state *resp; /* Backing resolver state. */
+ /* Extended resolver state. This is set to NULL if the
+ __resolv_context_get functions are unable to locate an associated
+ extended state. In this case, the configuration data in *resp
+ has to be used; otherwise, the data from *conf should be
+ preferred (because it is a superset). */
+ struct resolv_conf *conf;
/* The following fields are for internal use within the
resolv_context module. */