From 1eb000945055b7db51b18ce3489c0afe845582f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 29 May 2024 10:54:44 +0200 Subject: [PATCH 1/3] core/bpf-firewall: constify and reduce scope of variables --- src/core/bpf-firewall.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/src/core/bpf-firewall.c b/src/core/bpf-firewall.c index 185ed7d0708..29f62693ee4 100644 --- a/src/core/bpf-firewall.c +++ b/src/core/bpf-firewall.c @@ -421,14 +421,13 @@ static int bpf_firewall_prepare_access_maps( _cleanup_close_ int ipv4_map_fd = -EBADF, ipv6_map_fd = -EBADF; size_t n_ipv4 = 0, n_ipv6 = 0; - Unit *p; int r; assert(ret_ipv4_map_fd); assert(ret_ipv6_map_fd); assert(ret_has_any); - for (p = u; p; p = UNIT_GET_SLICE(p)) { + for (Unit *p = u; p; p = UNIT_GET_SLICE(p)) { CGroupContext *cc; Set *prefixes; bool *reduced; @@ -459,7 +458,7 @@ static int bpf_firewall_prepare_access_maps( } if (n_ipv4 > 0) { - char *name = strjoina("4_", u->id); + const char *name = strjoina("4_", u->id); ipv4_map_fd = bpf_map_new( name, BPF_MAP_TYPE_LPM_TRIE, @@ -472,7 +471,7 @@ static int bpf_firewall_prepare_access_maps( } if (n_ipv6 > 0) { - char *name = strjoina("6_", u->id); + const char *name = strjoina("6_", u->id); ipv6_map_fd = bpf_map_new( name, BPF_MAP_TYPE_LPM_TRIE, @@ -484,7 +483,7 @@ static int bpf_firewall_prepare_access_maps( return ipv6_map_fd; } - for (p = u; p; p = UNIT_GET_SLICE(p)) { + for (Unit *p = u; p; p = UNIT_GET_SLICE(p)) { CGroupContext *cc; cc = unit_get_cgroup_context(p); @@ -511,7 +510,7 @@ static int bpf_firewall_prepare_accounting_maps(Unit *u, bool enabled, CGroupRun if (enabled) { if (crt->ip_accounting_ingress_map_fd < 0) { - char *name = strjoina("I_", u->id); + const char *name = strjoina("I_", u->id); r = bpf_map_new(name, BPF_MAP_TYPE_ARRAY, sizeof(int), sizeof(uint64_t), 2, 0); if (r < 0) return r; @@ -520,7 +519,7 @@ static int bpf_firewall_prepare_accounting_maps(Unit *u, bool enabled, CGroupRun } if (crt->ip_accounting_egress_map_fd < 0) { - char *name = strjoina("E_", u->id); + const char *name = strjoina("E_", u->id); r = bpf_map_new(name, BPF_MAP_TYPE_ARRAY, sizeof(int), sizeof(uint64_t), 2, 0); if (r < 0) return r; From 4199866ac5de13ff261b1a490bd77a68510a9d72 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 29 May 2024 12:51:08 +0200 Subject: [PATCH 2/3] basic/fd-util: drop unnecessary {} --- src/basic/fd-util.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/src/basic/fd-util.c b/src/basic/fd-util.c index da4ee63add8..f9cac3d99e9 100644 --- a/src/basic/fd-util.c +++ b/src/basic/fd-util.c @@ -764,8 +764,7 @@ int rearrange_stdio(int original_input_fd, int original_output_fd, int original_ } /* Let's assemble fd[] with the fds to install in place of stdin/stdout/stderr */ - for (int i = 0; i < 3; i++) { - + for (int i = 0; i < 3; i++) if (fd[i] < 0) fd[i] = null_fd; /* A negative parameter means: connect this one to /dev/null */ else if (fd[i] != i && fd[i] < 3) { @@ -778,20 +777,16 @@ int rearrange_stdio(int original_input_fd, int original_output_fd, int original_ fd[i] = copy_fd[i]; } - } /* At this point we now have the fds to use in fd[], and they are all above the stdio range, so that * we have freedom to move them around. If the fds already were at the right places then the specific * fds are -EBADF. Let's now move them to the right places. This is the point of no return. */ - for (int i = 0; i < 3; i++) { - + for (int i = 0; i < 3; i++) if (fd[i] == i) { - /* fd is already in place, but let's make sure O_CLOEXEC is off */ r = fd_cloexec(i, false); if (r < 0) goto finish; - } else { assert(fd[i] > 2); @@ -800,7 +795,6 @@ int rearrange_stdio(int original_input_fd, int original_output_fd, int original_ goto finish; } } - } r = 0; From 613b698eb45f733645a5a9ba1b497c6c76c7868b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 29 May 2024 12:47:41 +0200 Subject: [PATCH 3/3] basic/fd-util: drop report from fd_cloexec_many fd_cloexec_many promised to report if work was done, but that code was not effective, because it always reported true if any fds were open. But no callers care about the return value, so let's just drop this. --- src/basic/fd-util.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/basic/fd-util.c b/src/basic/fd-util.c index f9cac3d99e9..c33cc6f783b 100644 --- a/src/basic/fd-util.c +++ b/src/basic/fd-util.c @@ -212,9 +212,6 @@ int fd_cloexec_many(const int fds[], size_t n_fds, bool cloexec) { continue; RET_GATHER(r, fd_cloexec(*fd, cloexec)); - - if (r >= 0) - r = 1; /* report if we did anything */ } return r;