Proper systemd escaping

This fixes the use of all sorts of characters in profile names/interface names.

5 files changed, 28 insertions, 18 deletions

diff --git a/services/netctl-auto@.service b/services/netctl-auto@.service
index 704c039..0ee3198 100644
--- a/services/netctl-auto@.service
+++ b/services/netctl-auto@.service
@@ -7,8 +7,8 @@ Before=network.target
 Wants=network.target
 
 [Service]
-ExecStart=/usr/bin/netctl-auto start %i
-ExecStop=/usr/bin/netctl-auto stop %i
+ExecStart=/usr/bin/netctl-auto start %I
+ExecStop=/usr/bin/netctl-auto stop %I
 RemainAfterExit=yes
 Type=forking
 
diff --git a/services/netctl-ifplugd@.service b/services/netctl-ifplugd@.service
index bc04512..796ebe3 100644
--- a/services/netctl-ifplugd@.service
+++ b/services/netctl-ifplugd@.service
@@ -5,7 +5,7 @@ BindsTo=sys-subsystem-net-devices-%i.device
 After=sys-subsystem-net-devices-%i.device
 
 [Service]
-ExecStart=/usr/bin/ifplugd -i %i -r /etc/ifplugd/netctl.action -bfIns
+ExecStart=/usr/bin/ifplugd -i %I -r /etc/ifplugd/netctl.action -bfIns
 
 [Install]
 WantedBy=multi-user.target
diff --git a/services/netctl@.service b/services/netctl@.service
index 9468951..74fc7d6 100644
--- a/services/netctl@.service
+++ b/services/netctl@.service
@@ -1,5 +1,5 @@
 [Unit]
-Description=Networking for netctl profile %i
+Description=Networking for netctl profile %I
 Documentation=man:netctl.profile(5)
 Before=network.target netctl.service
 Wants=network.target
@@ -7,6 +7,6 @@ Wants=network.target
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart=/usr/lib/network/network start %i
-ExecStop=/usr/lib/network/network stop %i
+ExecStart=/usr/lib/network/network start %I
+ExecStop=/usr/lib/network/network stop %I
 KillMode=none
diff --git a/src/lib/8021x b/src/lib/8021x
index fa23dd3..7a841a4 100644
--- a/src/lib/8021x
+++ b/src/lib/8021x
@@ -2,7 +2,7 @@
 
 
 ## Wrapper around wpa_cli to deal with supplicant configurations that set a
-## non-standard control path.
+## non-standard control path
 # $1: interface name
 # $2...: call to the supplicant
 wpa_call() {
diff --git a/src/netctl b/src/netctl
index aac0dac..9e14e55 100755
--- a/src/netctl
+++ b/src/netctl
@@ -14,7 +14,7 @@ Commands:
   list                 List available profiles
   store                Save which profiles are active
   restore              Load saved profiles
-  stop-all             Stops all profiles.
+  stop-all             Stops all profiles
   start [PROFILE]      Start a profile
   stop [PROFILE]       Stop a profile
   restart [PROFILE]    Restart a profile
@@ -26,12 +26,22 @@ Commands:
 END
 }
 
-# Wrapper around systemctl to convert profile names to unit names.
+sd_escape() {
+    local IFS=''
+    # Prevent a recursion loop on backspaces
+    set "${@//\\/\\x5c}"
+    while [[ "$*" =~ [^[:alnum:].:_/\\] ]]; do
+        set "${@//$BASH_REMATCH/$(printf '\\x%x' "'$BASH_REMATCH")}"
+    done
+    printf '%s\n' "${@//\//-}"
+}
+
+# Wrapper around systemctl to convert profile names to unit names
 sd_call() {
-    local cmd=$1 units
+    local command=$1
     shift
-    mapfile -t units < <(printf 'netctl@%s.service\n' "$@")
-    systemctl $cmd "${units[@]}"
+    set $(sd_escape "$@")
+    systemctl $command $(printf 'netctl@%s.service\n' "$@")
 }
 
 list() {
@@ -90,7 +100,7 @@ switch_to() {
 }
 
 unit_enable() {
-    local unit="/etc/systemd/system/netctl@$1.service"
+    local unit="/etc/systemd/system/netctl@$(sd_escape "$1").service"
     if [[ -e $unit ]]; then
         report_error "A unit file for profile '$1' already exists"
         return 1
@@ -100,13 +110,13 @@ unit_enable() {
     echo -e "\n[Unit]" >> "$unit"
     [[ -n $Description ]] && echo "Description=$Description" >> "$unit"
     : ${BindsToInterfaces=$Interface}
-    BindsToInterfaces=( "${BindsToInterfaces[@]//-/\\x2d}" )
     printf 'BindsTo=sys-subsystem-net-devices-%s.device\n' \
-           "${BindsToInterfaces[@]}" >> "$unit"
+           $(sd_escape "${BindsToInterfaces[@]}") >> "$unit"
     printf 'After=sys-subsystem-net-devices-%s.device\n' \
-           "${BindsToInterfaces[@]}" >> "$unit"
+           $(sd_escape "${BindsToInterfaces[@]}") >> "$unit"
     if [[ -n $After ]]; then
-        printf 'After="netctl@%s.service"\n' "${After[@]//\"/\\\"}" >> "$unit"
+        printf 'After="netctl@%s.service"\n' \
+               $(sd_escape "${After[@]}") >> "$unit"
     fi
     echo "ln -s '$unit' '${unit/system\//system/multi-user.target.wants/}'"
     ln -s "$unit" "${unit/system\//system/multi-user.target.wants/}"
@@ -114,7 +124,7 @@ unit_enable() {
 }
 
 unit_disable() {
-    local unit="/etc/systemd/system/netctl@$1.service"
+    local unit="/etc/systemd/system/netctl@$(sd_escape "$1").service"
     if sd_call "is-enabled --quiet" "$1" &> /dev/null; then
         sd_call disable "$1"
     fi