Fix unsafe unwrap and improve error handling in network device operations.

Signed-off-by: nayuta-ai <[email protected]>

Author: nayuta-ai

crates/libcontainer/src/process/container_main_process.rs

@@ -3,9 +3,10 @@ use std::path::PathBuf;
 
 use nix::sys::wait::{waitpid, WaitStatus};
 use nix::unistd::Pid;
-use oci_spec::runtime::{Linux, LinuxNamespaceType};
+use oci_spec::runtime::{Linux, LinuxNamespace, LinuxNamespaceType};
 
 use crate::network::network_device::dev_change_net_namespace;
+use crate::network::serialize::SerializableAddress;
 use crate::process::args::ContainerArgs;
 use crate::process::fork::{self, CloneCb};
 use crate::process::intel_rdt::setup_intel_rdt;
@@ -244,7 +245,6 @@ fn setup_network_device(
     main_receiver: &mut channel::MainReceiver,
     init_sender: &mut channel::InitSender,
 ) -> Result<()> {
-    let mut addrs_map = HashMap::new();
     // host network pods does not move network devices.
     if let Some(namespaces) = linux.namespaces() {
         if !namespaces
@@ -274,18 +274,17 @@ fn setup_network_device(
         // See: https://github.com/opencontainers/runtime-spec/blob/27cb0027fd92ef81eda1ea3a8153b8337f56d94a/config-linux.md#namespace-lifecycle-and-container-termination
         if let Some(devices) = linux.net_devices() {
             main_receiver.wait_for_network_setup_ready()?;
-            for (name, net_dev) in devices {
-                let addrs = dev_change_net_namespace(
-                    name,
-                    ns_path,
-                    net_dev,
-                )
-                .map_err(|err| {
-                    tracing::error!("failed to dev_change_net_namespace: {}", err);
-                    err
-                })?;
-                addrs_map.insert(name.clone(), addrs);
-            }
+            let addrs_map = devices
+                .iter()
+                .map(|(name, net_dev)| {
+                    let addrs =
+                        dev_change_net_namespace(name, ns_path, net_dev).map_err(|err| {
+                            tracing::error!("failed to dev_change_net_namespace: {}", err);
+                            err
+                        })?;
+                    Ok((name.clone(), addrs))
+                })
+                .collect::<Result<HashMap<String, Vec<SerializableAddress>>>>()?;
             init_sender.move_network_device(addrs_map)?;
         }
     }

crates/libcontainer/src/process/init/process.rs

@@ -882,12 +882,10 @@ fn setup_net_devices(
     let addrs_map = init_receiver.wait_for_move_network_device()?;
     for (name, net_dev) in net_device {
         if let Some(serialize_addrs) = addrs_map.get(name) {
-            setup_network_device(name, net_dev, serialize_addrs.clone()).map_err(
-                |err| {
-                    tracing::error!(?err, "failed to setup_network_device");
-                    err
-                },
-            )?;
+            setup_network_device(name, net_dev, serialize_addrs.clone()).map_err(|err| {
+                tracing::error!(?err, "failed to setup_network_device");
+                err
+            })?;
         }
     }
 

crates/libcontainer/src/utils.rs

@@ -349,7 +349,7 @@ pub fn validate_spec_for_net_devices(
             .any(|ns| ns.typ() == LinuxNamespaceType::Network),
         None => false,
     };
-    
+
     if !has_net_namespace {
         return Err(NetDevicesError::NoNetNamespace);
     }
@@ -360,7 +360,7 @@ pub fn validate_spec_for_net_devices(
     }
 
     if let Some(devices) = linux.net_devices() {
-        for (name, net_dev) in devices {
+        devices.iter().try_for_each(|(name, net_dev)| {
             if !dev_valid_name(name) {
                 return Err(NetDevicesError::InvalidDeviceName(name.into()));
             }
@@ -369,7 +369,8 @@ pub fn validate_spec_for_net_devices(
                     return Err(NetDevicesError::InvalidDeviceName(dev_name.into()));
                 }
             }
-        }
+            Ok(())
+        })?;
     }
 
     Ok(())
@@ -581,9 +582,7 @@ mod tests {
             .map(|(key, val)| {
                 (
                     key.into(),
-                    LinuxNetDevice::default()
-                        .set_name(Some(val.into()))
-                        .clone(),
+                    LinuxNetDevice::default().set_name(Some(val.into())).clone(),
                 )
             })
             .collect();