src/network/networkd-address.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <net/if.h>
   4 #include <net/if_arp.h>
   5
   6 #include "alloc-util.h"
   7 #include "firewall-util.h"
   8 #include "logarithm.h"
   9 #include "memory-util.h"
  10 #include "netlink-util.h"
  11 #include "networkd-address-pool.h"
  12 #include "networkd-address.h"
  13 #include "networkd-dhcp-server.h"
  14 #include "networkd-ipv4acd.h"
  15 #include "networkd-manager.h"
  16 #include "networkd-netlabel.h"
  17 #include "networkd-network.h"
  18 #include "networkd-queue.h"
  19 #include "networkd-route-util.h"
  20 #include "networkd-route.h"
  21 #include "parse-util.h"
  22 #include "string-util.h"
  23 #include "strv.h"
  24 #include "strxcpyx.h"
  25
  26 #define ADDRESSES_PER_LINK_MAX 2048U
  27 #define STATIC_ADDRESSES_PER_NETWORK_MAX 1024U
  28
  29 #define KNOWN_FLAGS                             \
  30         (IFA_F_SECONDARY |                      \
  31          IFA_F_NODAD |                          \
  32          IFA_F_OPTIMISTIC |                     \
  33          IFA_F_DADFAILED |                      \
  34          IFA_F_HOMEADDRESS |                    \
  35          IFA_F_DEPRECATED |                     \
  36          IFA_F_TENTATIVE |                      \
  37          IFA_F_PERMANENT |                      \
  38          IFA_F_MANAGETEMPADDR |                 \
  39          IFA_F_NOPREFIXROUTE |                  \
  40          IFA_F_MCAUTOJOIN |                     \
  41          IFA_F_STABLE_PRIVACY)
  42
  43 /* From net/ipv4/devinet.c */
  44 #define IPV6ONLY_FLAGS                          \
  45         (IFA_F_NODAD |                          \
  46          IFA_F_OPTIMISTIC |                     \
  47          IFA_F_DADFAILED |                      \
  48          IFA_F_HOMEADDRESS |                    \
  49          IFA_F_TENTATIVE |                      \
  50          IFA_F_MANAGETEMPADDR |                 \
  51          IFA_F_STABLE_PRIVACY)
  52
  53 /* We do not control the following flags. */
  54 #define UNMANAGED_FLAGS                         \
  55         (IFA_F_SECONDARY |                      \
  56          IFA_F_DADFAILED |                      \
  57          IFA_F_DEPRECATED |                     \
  58          IFA_F_TENTATIVE |                      \
  59          IFA_F_PERMANENT |                      \
  60          IFA_F_STABLE_PRIVACY)
  61
  62 int address_flags_to_string_alloc(uint32_t flags, int family, char **ret) {
  63         _cleanup_free_ char *str = NULL;
  64         static const char* map[] = {
  65                 [LOG2U(IFA_F_SECONDARY)]      = "secondary", /* This is also called "temporary" for ipv6. */
  66                 [LOG2U(IFA_F_NODAD)]          = "nodad",
  67                 [LOG2U(IFA_F_OPTIMISTIC)]     = "optimistic",
  68                 [LOG2U(IFA_F_DADFAILED)]      = "dadfailed",
  69                 [LOG2U(IFA_F_HOMEADDRESS)]    = "home-address",
  70                 [LOG2U(IFA_F_DEPRECATED)]     = "deprecated",
  71                 [LOG2U(IFA_F_TENTATIVE)]      = "tentative",
  72                 [LOG2U(IFA_F_PERMANENT)]      = "permanent",
  73                 [LOG2U(IFA_F_MANAGETEMPADDR)] = "manage-temporary-address",
  74                 [LOG2U(IFA_F_NOPREFIXROUTE)]  = "no-prefixroute",
  75                 [LOG2U(IFA_F_MCAUTOJOIN)]     = "auto-join",
  76                 [LOG2U(IFA_F_STABLE_PRIVACY)] = "stable-privacy",
  77         };
  78
  79         assert(IN_SET(family, AF_INET, AF_INET6));
  80         assert(ret);
  81
  82         for (size_t i = 0; i < ELEMENTSOF(map); i++)
  83                 if (FLAGS_SET(flags, 1 << i) && map[i])
  84                         if (!strextend_with_separator(
  85                                             &str, ",",
  86                                             family == AF_INET6 && (1 << i) == IFA_F_SECONDARY ? "temporary" : map[i]))
  87                                 return -ENOMEM;
  88
  89         *ret = TAKE_PTR(str);
  90         return 0;
  91 }
  92
  93 static LinkAddressState address_state_from_scope(uint8_t scope) {
  94         if (scope < RT_SCOPE_SITE)
  95                 /* universally accessible addresses found */
  96                 return LINK_ADDRESS_STATE_ROUTABLE;
  97
  98         if (scope < RT_SCOPE_HOST)
  99                 /* only link or site local addresses found */
 100                 return LINK_ADDRESS_STATE_DEGRADED;
 101
 102         /* no useful addresses found */
 103         return LINK_ADDRESS_STATE_OFF;
 104 }
 105
 106 void link_get_address_states(
 107                 Link *link,
 108                 LinkAddressState *ret_ipv4,
 109                 LinkAddressState *ret_ipv6,
 110                 LinkAddressState *ret_all) {
 111
 112         uint8_t ipv4_scope = RT_SCOPE_NOWHERE, ipv6_scope = RT_SCOPE_NOWHERE;
 113         Address *address;
 114
 115         assert(link);
 116
 117         SET_FOREACH(address, link->addresses) {
 118                 if (!address_is_ready(address))
 119                         continue;
 120
 121                 if (address->family == AF_INET)
 122                         ipv4_scope = MIN(ipv4_scope, address->scope);
 123
 124                 if (address->family == AF_INET6)
 125                         ipv6_scope = MIN(ipv6_scope, address->scope);
 126         }
 127
 128         if (ret_ipv4)
 129                 *ret_ipv4 = address_state_from_scope(ipv4_scope);
 130         if (ret_ipv6)
 131                 *ret_ipv6 = address_state_from_scope(ipv6_scope);
 132         if (ret_all)
 133                 *ret_all = address_state_from_scope(MIN(ipv4_scope, ipv6_scope));
 134 }
 135
 136 int address_new(Address **ret) {
 137         _cleanup_(address_freep) Address *address = NULL;
 138
 139         address = new(Address, 1);
 140         if (!address)
 141                 return -ENOMEM;
 142
 143         *address = (Address) {
 144                 .family = AF_UNSPEC,
 145                 .scope = RT_SCOPE_UNIVERSE,
 146                 .lifetime_valid_usec = USEC_INFINITY,
 147                 .lifetime_preferred_usec = USEC_INFINITY,
 148                 .set_broadcast = -1,
 149         };
 150
 151         *ret = TAKE_PTR(address);
 152
 153         return 0;
 154 }
 155
 156 int address_new_static(Network *network, const char *filename, unsigned section_line, Address **ret) {
 157         _cleanup_(config_section_freep) ConfigSection *n = NULL;
 158         _cleanup_(address_freep) Address *address = NULL;
 159         int r;
 160
 161         assert(network);
 162         assert(ret);
 163         assert(filename);
 164         assert(section_line > 0);
 165
 166         r = config_section_new(filename, section_line, &n);
 167         if (r < 0)
 168                 return r;
 169
 170         address = ordered_hashmap_get(network->addresses_by_section, n);
 171         if (address) {
 172                 *ret = TAKE_PTR(address);
 173                 return 0;
 174         }
 175
 176         if (ordered_hashmap_size(network->addresses_by_section) >= STATIC_ADDRESSES_PER_NETWORK_MAX)
 177                 return -E2BIG;
 178
 179         r = address_new(&address);
 180         if (r < 0)
 181                 return r;
 182
 183         address->network = network;
 184         address->section = TAKE_PTR(n);
 185         address->source = NETWORK_CONFIG_SOURCE_STATIC;
 186         /* This will be adjusted in address_section_verify(). */
 187         address->duplicate_address_detection = _ADDRESS_FAMILY_INVALID;
 188
 189         r = ordered_hashmap_ensure_put(&network->addresses_by_section, &config_section_hash_ops, address->section, address);
 190         if (r < 0)
 191                 return r;
 192
 193         *ret = TAKE_PTR(address);
 194         return 0;
 195 }
 196
 197 Address *address_free(Address *address) {
 198         if (!address)
 199                 return NULL;
 200
 201         if (address->network) {
 202                 assert(address->section);
 203                 ordered_hashmap_remove(address->network->addresses_by_section, address->section);
 204         }
 205
 206         if (address->link) {
 207                 set_remove(address->link->addresses, address);
 208
 209                 if (address->family == AF_INET6 &&
 210                     in6_addr_equal(&address->in_addr.in6, &address->link->ipv6ll_address))
 211                         memzero(&address->link->ipv6ll_address, sizeof(struct in6_addr));
 212
 213                 ipv4acd_detach(address->link, address);
 214         }
 215
 216         config_section_free(address->section);
 217         free(address->label);
 218         free(address->netlabel);
 219         nft_set_context_clear(&address->nft_set_context);
 220         return mfree(address);
 221 }
 222
 223 static bool address_lifetime_is_valid(const Address *a) {
 224         assert(a);
 225
 226         return
 227                 a->lifetime_valid_usec == USEC_INFINITY ||
 228                 a->lifetime_valid_usec > now(CLOCK_BOOTTIME);
 229 }
 230
 231 bool address_is_ready(const Address *a) {
 232         assert(a);
 233         assert(a->link);
 234
 235         if (!ipv4acd_bound(a->link, a))
 236                 return false;
 237
 238         if (FLAGS_SET(a->flags, IFA_F_TENTATIVE))
 239                 return false;
 240
 241         if (FLAGS_SET(a->state, NETWORK_CONFIG_STATE_REMOVING))
 242                 return false;
 243
 244         if (!FLAGS_SET(a->state, NETWORK_CONFIG_STATE_CONFIGURED))
 245                 return false;
 246
 247         return address_lifetime_is_valid(a);
 248 }
 249
 250 bool link_check_addresses_ready(Link *link, NetworkConfigSource source) {
 251         Address *a;
 252         bool has = false;
 253
 254         assert(link);
 255
 256         /* Check if all addresses on the interface are ready. If there is no address, this will return false. */
 257
 258         SET_FOREACH(a, link->addresses) {
 259                 if (source >= 0 && a->source != source)
 260                         continue;
 261                 if (address_is_marked(a))
 262                         continue;
 263                 if (!address_exists(a))
 264                         continue;
 265                 if (!address_is_ready(a))
 266                         return false;
 267                 has = true;
 268         }
 269
 270         return has;
 271 }
 272
 273 void link_mark_addresses(Link *link, NetworkConfigSource source) {
 274         Address *a;
 275
 276         assert(link);
 277
 278         SET_FOREACH(a, link->addresses) {
 279                 if (a->source != source)
 280                         continue;
 281
 282                 address_mark(a);
 283         }
 284 }
 285
 286 static int address_get_broadcast(const Address *a, Link *link, struct in_addr *ret) {
 287         struct in_addr b_addr = {};
 288
 289         assert(a);
 290         assert(link);
 291
 292         /* Returns 0 when broadcast address is null, 1 when non-null broadcast address, -EAGAIN when the main
 293          * address is null. */
 294
 295         /* broadcast is only for IPv4. */
 296         if (a->family != AF_INET)
 297                 goto finalize;
 298
 299         /* broadcast address cannot be used when peer address is specified. */
 300         if (in4_addr_is_set(&a->in_addr_peer.in))
 301                 goto finalize;
 302
 303         /* A /31 or /32 IPv4 address does not have a broadcast address.
 304          * See https://tools.ietf.org/html/rfc3021 */
 305         if (a->prefixlen > 30)
 306                 goto finalize;
 307
 308         /* If explicitly configured, use the address as is. */
 309         if (in4_addr_is_set(&a->broadcast)) {
 310                 b_addr = a->broadcast;
 311                 goto finalize;
 312         }
 313
 314         /* If explicitly disabled, then return null address. */
 315         if (a->set_broadcast == 0)
 316                 goto finalize;
 317
 318         /* For wireguard interfaces, broadcast is disabled by default. */
 319         if (a->set_broadcast < 0 && streq_ptr(link->kind, "wireguard"))
 320                 goto finalize;
 321
 322         /* If the main address is null, e.g. Address=0.0.0.0/24, the broadcast address will be automatically
 323          * determined after an address is acquired. */
 324         if (!in4_addr_is_set(&a->in_addr.in))
 325                 return -EAGAIN;
 326
 327         /* Otherwise, generate a broadcast address from the main address and prefix length. */
 328         b_addr.s_addr = a->in_addr.in.s_addr | htobe32(UINT32_C(0xffffffff) >> a->prefixlen);
 329
 330 finalize:
 331         if (ret)
 332                 *ret = b_addr;
 333
 334         return in4_addr_is_set(&b_addr);
 335 }
 336
 337 static void address_set_broadcast(Address *a, Link *link) {
 338         assert(a);
 339         assert_se(address_get_broadcast(a, link, &a->broadcast) >= 0);
 340 }
 341
 342 static void address_set_cinfo(Manager *m, const Address *a, struct ifa_cacheinfo *cinfo) {
 343         usec_t now_usec;
 344
 345         assert(m);
 346         assert(a);
 347         assert(cinfo);
 348
 349         assert_se(sd_event_now(m->event, CLOCK_BOOTTIME, &now_usec) >= 0);
 350
 351         *cinfo = (struct ifa_cacheinfo) {
 352                 .ifa_valid = usec_to_sec(a->lifetime_valid_usec, now_usec),
 353                 .ifa_prefered = usec_to_sec(a->lifetime_preferred_usec, now_usec),
 354         };
 355 }
 356
 357 static void address_set_lifetime(Manager *m, Address *a, const struct ifa_cacheinfo *cinfo) {
 358         usec_t now_usec;
 359
 360         assert(m);
 361         assert(a);
 362         assert(cinfo);
 363
 364         assert_se(sd_event_now(m->event, CLOCK_BOOTTIME, &now_usec) >= 0);
 365
 366         a->lifetime_valid_usec = sec_to_usec(cinfo->ifa_valid, now_usec);
 367         a->lifetime_preferred_usec = sec_to_usec(cinfo->ifa_prefered, now_usec);
 368 }
 369
 370 static bool address_is_static_null(const Address *address) {
 371         assert(address);
 372
 373         if (!address->network)
 374                 return false;
 375
 376         if (!address->requested_as_null)
 377                 return false;
 378
 379         assert(!in_addr_is_set(address->family, &address->in_addr));
 380         return true;
 381 }
 382
 383 static int address_ipv4_prefix(const Address *a, struct in_addr *ret) {
 384         struct in_addr p;
 385         int r;
 386
 387         assert(a);
 388         assert(a->family == AF_INET);
 389         assert(ret);
 390
 391         p = in4_addr_is_set(&a->in_addr_peer.in) ? a->in_addr_peer.in : a->in_addr.in;
 392         r = in4_addr_mask(&p, a->prefixlen);
 393         if (r < 0)
 394                 return r;
 395
 396         *ret = p;
 397         return 0;
 398 }
 399
 400 static void address_hash_func(const Address *a, struct siphash *state) {
 401         assert(a);
 402
 403         siphash24_compress(&a->family, sizeof(a->family), state);
 404
 405         switch (a->family) {
 406         case AF_INET: {
 407                 struct in_addr prefix;
 408
 409                 siphash24_compress(&a->prefixlen, sizeof(a->prefixlen), state);
 410
 411                 assert_se(address_ipv4_prefix(a, &prefix) >= 0);
 412                 siphash24_compress(&prefix, sizeof(prefix), state);
 413
 414                 siphash24_compress(&a->in_addr.in, sizeof(a->in_addr.in), state);
 415                 break;
 416         }
 417         case AF_INET6:
 418                 siphash24_compress(&a->in_addr.in6, sizeof(a->in_addr.in6), state);
 419
 420                 if (in6_addr_is_null(&a->in_addr.in6))
 421                         siphash24_compress(&a->prefixlen, sizeof(a->prefixlen), state);
 422                 break;
 423
 424         default:
 425                 /* treat any other address family as AF_UNSPEC */
 426                 break;
 427         }
 428 }
 429
 430 static int address_compare_func(const Address *a1, const Address *a2) {
 431         int r;
 432
 433         r = CMP(a1->family, a2->family);
 434         if (r != 0)
 435                 return r;
 436
 437         switch (a1->family) {
 438         case AF_INET: {
 439                 struct in_addr p1, p2;
 440
 441                 /* See kernel's find_matching_ifa() in net/ipv4/devinet.c */
 442                 r = CMP(a1->prefixlen, a2->prefixlen);
 443                 if (r != 0)
 444                         return r;
 445
 446                 assert_se(address_ipv4_prefix(a1, &p1) >= 0);
 447                 assert_se(address_ipv4_prefix(a2, &p2) >= 0);
 448                 r = memcmp(&p1, &p2, sizeof(p1));
 449                 if (r != 0)
 450                         return r;
 451
 452                 return memcmp(&a1->in_addr.in, &a2->in_addr.in, sizeof(a1->in_addr.in));
 453         }
 454         case AF_INET6:
 455                 /* See kernel's ipv6_get_ifaddr() in net/ipv6/addrconf.c */
 456                 r = memcmp(&a1->in_addr.in6, &a2->in_addr.in6, sizeof(a1->in_addr.in6));
 457                 if (r != 0)
 458                         return r;
 459
 460                 /* To distinguish IPv6 null addresses with different prefixlen, e.g. ::48 vs ::64, let's
 461                  * compare the prefix length. */
 462                 if (in6_addr_is_null(&a1->in_addr.in6))
 463                         r = CMP(a1->prefixlen, a2->prefixlen);
 464
 465                 return r;
 466
 467         default:
 468                 /* treat any other address family as AF_UNSPEC */
 469                 return 0;
 470         }
 471 }
 472
 473 DEFINE_HASH_OPS(
 474         address_hash_ops,
 475         Address,
 476         address_hash_func,
 477         address_compare_func);
 478
 479 DEFINE_PRIVATE_HASH_OPS_WITH_KEY_DESTRUCTOR(
 480         address_hash_ops_free,
 481         Address,
 482         address_hash_func,
 483         address_compare_func,
 484         address_free);
 485
 486 static bool address_can_update(const Address *la, const Address *na) {
 487         assert(la);
 488         assert(la->link);
 489         assert(na);
 490         assert(na->network);
 491
 492         /*
 493          * property     |    IPv4     |  IPv6
 494          * -----------------------------------------
 495          * family       |      ✗      |     ✗
 496          * prefixlen    |      ✗      |     ✗
 497          * address      |      ✗      |     ✗
 498          * scope        |      ✗      |     -
 499          * label        |      ✗      |     -
 500          * broadcast    |      ✗      |     -
 501          * peer         |      ✗      |     ✓
 502          * flags        |      ✗      |     ✓
 503          * lifetime     |      ✓      |     ✓
 504          * route metric |      ✓      |     ✓
 505          * protocol     |      ✓      |     ✓
 506          *
 507          * ✗ : cannot be changed
 508          * ✓ : can be changed
 509          * - : unused
 510          *
 511          * IPv4 : See inet_rtm_newaddr() in net/ipv4/devinet.c.
 512          * IPv6 : See inet6_addr_modify() in net/ipv6/addrconf.c.
 513          */
 514
 515         if (la->family != na->family)
 516                 return false;
 517
 518         if (la->prefixlen != na->prefixlen)
 519                 return false;
 520
 521         /* When a null address is requested, the address to be assigned/updated will be determined later. */
 522         if (!address_is_static_null(na) &&
 523             in_addr_equal(la->family, &la->in_addr, &na->in_addr) <= 0)
 524                 return false;
 525
 526         switch (la->family) {
 527         case AF_INET: {
 528                 struct in_addr bcast;
 529
 530                 if (la->scope != na->scope)
 531                         return false;
 532                 if (((la->flags ^ na->flags) & KNOWN_FLAGS & ~IPV6ONLY_FLAGS & ~UNMANAGED_FLAGS) != 0)
 533                         return false;
 534                 if (!streq_ptr(la->label, na->label))
 535                         return false;
 536                 if (!in4_addr_equal(&la->in_addr_peer.in, &na->in_addr_peer.in))
 537                         return false;
 538                 if (address_get_broadcast(na, la->link, &bcast) >= 0) {
 539                         /* If the broadcast address can be determined now, check if they match. */
 540                         if (!in4_addr_equal(&la->broadcast, &bcast))
 541                                 return false;
 542                 } else {
 543                         /* When a null address is requested, then the broadcast address will be
 544                          * automatically calculated from the acquired address, e.g.
 545                          *     192.168.0.10/24 -> 192.168.0.255
 546                          * So, here let's only check if the broadcast is the last address in the range, e.g.
 547                          *     0.0.0.0/24 -> 0.0.0.255 */
 548                         if (!FLAGS_SET(la->broadcast.s_addr, htobe32(UINT32_C(0xffffffff) >> la->prefixlen)))
 549                                 return false;
 550                 }
 551                 break;
 552         }
 553         case AF_INET6:
 554                 break;
 555
 556         default:
 557                 assert_not_reached();
 558         }
 559
 560         return true;
 561 }
 562
 563 int address_dup(const Address *src, Address **ret) {
 564         _cleanup_(address_freep) Address *dest = NULL;
 565         int r;
 566
 567         assert(src);
 568         assert(ret);
 569
 570         dest = newdup(Address, src, 1);
 571         if (!dest)
 572                 return -ENOMEM;
 573
 574         /* clear all pointers */
 575         dest->network = NULL;
 576         dest->section = NULL;
 577         dest->link = NULL;
 578         dest->label = NULL;
 579         dest->netlabel = NULL;
 580         dest->nft_set_context.sets = NULL;
 581         dest->nft_set_context.n_sets = 0;
 582
 583         if (src->family == AF_INET) {
 584                 r = free_and_strdup(&dest->label, src->label);
 585                 if (r < 0)
 586                         return r;
 587         }
 588
 589         r = free_and_strdup(&dest->netlabel, src->netlabel);
 590         if (r < 0)
 591                 return r;
 592
 593         r = nft_set_context_dup(&src->nft_set_context, &dest->nft_set_context);
 594         if (r < 0)
 595                 return r;
 596
 597         *ret = TAKE_PTR(dest);
 598         return 0;
 599 }
 600
 601 static int address_set_masquerade(Address *address, bool add) {
 602         union in_addr_union masked;
 603         int r;
 604
 605         assert(address);
 606         assert(address->link);
 607
 608         if (!address->link->network)
 609                 return 0;
 610
 611         if (address->family == AF_INET &&
 612             !FLAGS_SET(address->link->network->ip_masquerade, ADDRESS_FAMILY_IPV4))
 613                 return 0;
 614
 615         if (address->family == AF_INET6 &&
 616             !FLAGS_SET(address->link->network->ip_masquerade, ADDRESS_FAMILY_IPV6))
 617                 return 0;
 618
 619         if (address->scope >= RT_SCOPE_LINK)
 620                 return 0;
 621
 622         if (address->ip_masquerade_done == add)
 623                 return 0;
 624
 625         masked = address->in_addr;
 626         r = in_addr_mask(address->family, &masked, address->prefixlen);
 627         if (r < 0)
 628                 return r;
 629
 630         r = fw_add_masquerade(&address->link->manager->fw_ctx, add, address->family, &masked, address->prefixlen);
 631         if (r < 0)
 632                 return r;
 633
 634         address->ip_masquerade_done = add;
 635
 636         return 0;
 637 }
 638
 639 static void address_modify_nft_set_context(Address *address, bool add, NFTSetContext *nft_set_context) {
 640         int r;
 641
 642         assert(address);
 643         assert(address->link);
 644         assert(address->link->manager);
 645         assert(nft_set_context);
 646
 647         if (!address->link->manager->fw_ctx) {
 648                 r = fw_ctx_new_full(&address->link->manager->fw_ctx, /* init_tables= */ false);
 649                 if (r < 0)
 650                         return;
 651         }
 652
 653         FOREACH_ARRAY(nft_set, nft_set_context->sets, nft_set_context->n_sets) {
 654                 uint32_t ifindex;
 655
 656                 assert(nft_set);
 657
 658                 switch (nft_set->source) {
 659                 case NFT_SET_SOURCE_ADDRESS:
 660                         r = nft_set_element_modify_ip(address->link->manager->fw_ctx, add, nft_set->nfproto, address->family, nft_set->table, nft_set->set,
 661                                                       &address->in_addr);
 662                         break;
 663                 case NFT_SET_SOURCE_PREFIX:
 664                         r = nft_set_element_modify_iprange(address->link->manager->fw_ctx, add, nft_set->nfproto, address->family, nft_set->table, nft_set->set,
 665                                                            &address->in_addr, address->prefixlen);
 666                         break;
 667                 case NFT_SET_SOURCE_IFINDEX:
 668                         ifindex = address->link->ifindex;
 669                         r = nft_set_element_modify_any(address->link->manager->fw_ctx, add, nft_set->nfproto, nft_set->table, nft_set->set,
 670                                                        &ifindex, sizeof(ifindex));
 671                         break;
 672                 default:
 673                         assert_not_reached();
 674                 }
 675
 676                 if (r < 0)
 677                         log_warning_errno(r, "Failed to %s NFT set: family %s, table %s, set %s, IP address %s, ignoring: %m",
 678                                           add ? "add" : "delete",
 679                                           nfproto_to_string(nft_set->nfproto), nft_set->table, nft_set->set,
 680                                           IN_ADDR_PREFIX_TO_STRING(address->family, &address->in_addr, address->prefixlen));
 681                 else
 682                         log_debug("%s NFT set: family %s, table %s, set %s, IP address %s",
 683                                   add ? "Added" : "Deleted",
 684                                   nfproto_to_string(nft_set->nfproto), nft_set->table, nft_set->set,
 685                                   IN_ADDR_PREFIX_TO_STRING(address->family, &address->in_addr, address->prefixlen));
 686         }
 687 }
 688
 689 static void address_modify_nft_set(Address *address, bool add) {
 690         assert(address);
 691         assert(address->link);
 692
 693         if (!IN_SET(address->family, AF_INET, AF_INET6))
 694                 return;
 695
 696         if (!address->link->network)
 697                 return;
 698
 699         switch (address->source) {
 700         case NETWORK_CONFIG_SOURCE_DHCP4:
 701                 return address_modify_nft_set_context(address, add, &address->link->network->dhcp_nft_set_context);
 702         case NETWORK_CONFIG_SOURCE_DHCP6:
 703                 return address_modify_nft_set_context(address, add, &address->link->network->dhcp6_nft_set_context);
 704         case NETWORK_CONFIG_SOURCE_DHCP_PD:
 705                 return address_modify_nft_set_context(address, add, &address->link->network->dhcp_pd_nft_set_context);
 706         case NETWORK_CONFIG_SOURCE_NDISC:
 707                 return address_modify_nft_set_context(address, add, &address->link->network->ndisc_nft_set_context);
 708         case NETWORK_CONFIG_SOURCE_STATIC:
 709                 return address_modify_nft_set_context(address, add, &address->nft_set_context);
 710         default:
 711                 return;
 712         }
 713 }
 714
 715 static int address_add(Link *link, Address *address) {
 716         int r;
 717
 718         assert(link);
 719         assert(address);
 720
 721         r = set_ensure_put(&link->addresses, &address_hash_ops_free, address);
 722         if (r < 0)
 723                 return r;
 724         if (r == 0)
 725                 return -EEXIST;
 726
 727         address->link = link;
 728         return 0;
 729 }
 730
 731 static int address_update(Address *address) {
 732         Link *link = ASSERT_PTR(ASSERT_PTR(address)->link);
 733         int r;
 734
 735         if (address_is_ready(address) &&
 736             address->family == AF_INET6 &&
 737             in6_addr_is_link_local(&address->in_addr.in6) &&
 738             in6_addr_is_null(&link->ipv6ll_address)) {
 739
 740                 link->ipv6ll_address = address->in_addr.in6;
 741
 742                 r = link_ipv6ll_gained(link);
 743                 if (r < 0)
 744                         return r;
 745         }
 746
 747         if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
 748                 return 0;
 749
 750         r = address_set_masquerade(address, /* add = */ true);
 751         if (r < 0)
 752                 return log_link_warning_errno(link, r, "Could not enable IP masquerading: %m");
 753
 754         address_add_netlabel(address);
 755
 756         address_modify_nft_set(address, /* add = */ true);
 757
 758         if (address_is_ready(address) && address->callback) {
 759                 r = address->callback(address);
 760                 if (r < 0)
 761                         return r;
 762         }
 763
 764         link_update_operstate(link, /* also_update_master = */ true);
 765         link_check_ready(link);
 766         return 0;
 767 }
 768
 769 static int address_drop(Address *address) {
 770         Link *link = ASSERT_PTR(ASSERT_PTR(address)->link);
 771         int r;
 772
 773         r = address_set_masquerade(address, /* add = */ false);
 774         if (r < 0)
 775                 log_link_warning_errno(link, r, "Failed to disable IP masquerading, ignoring: %m");
 776
 777         address_modify_nft_set(address, /* add = */ false);
 778
 779         address_del_netlabel(address);
 780
 781         address_free(address);
 782
 783         link_update_operstate(link, /* also_update_master = */ true);
 784         link_check_ready(link);
 785         return 0;
 786 }
 787
 788 static bool address_match_null(const Address *a, const Address *null_address) {
 789         assert(a);
 790         assert(null_address);
 791
 792         if (!a->requested_as_null)
 793                 return false;
 794
 795         /* Currently, null address is supported only by static addresses. Note that static
 796          * address may be set as foreign during reconfiguring the interface. */
 797         if (!IN_SET(a->source, NETWORK_CONFIG_SOURCE_FOREIGN, NETWORK_CONFIG_SOURCE_STATIC))
 798                 return false;
 799
 800         if (a->family != null_address->family)
 801                 return false;
 802
 803         if (a->prefixlen != null_address->prefixlen)
 804                 return false;
 805
 806         return true;
 807 }
 808
 809 static int address_get_request(Link *link, const Address *address, Request **ret) {
 810         Request *req;
 811
 812         assert(link);
 813         assert(link->manager);
 814         assert(address);
 815
 816         req = ordered_set_get(
 817                         link->manager->request_queue,
 818                         &(Request) {
 819                                 .link = link,
 820                                 .type = REQUEST_TYPE_ADDRESS,
 821                                 .userdata = (void*) address,
 822                                 .hash_func = (hash_func_t) address_hash_func,
 823                                 .compare_func = (compare_func_t) address_compare_func,
 824                         });
 825         if (req) {
 826                 if (ret)
 827                         *ret = req;
 828                 return 0;
 829         }
 830
 831         if (address_is_static_null(address))
 832                 ORDERED_SET_FOREACH(req, link->manager->request_queue) {
 833                         if (req->link != link)
 834                                 continue;
 835                         if (req->type != REQUEST_TYPE_ADDRESS)
 836                                 continue;
 837
 838                         if (!address_match_null(req->userdata, address))
 839                                 continue;
 840
 841                         if (ret)
 842                                 *ret = req;
 843
 844                         return 0;
 845                 }
 846
 847         return -ENOENT;
 848 }
 849
 850 int address_get(Link *link, const Address *in, Address **ret) {
 851         Address *a;
 852
 853         assert(link);
 854         assert(in);
 855
 856         a = set_get(link->addresses, in);
 857         if (a) {
 858                 if (ret)
 859                         *ret = a;
 860                 return 0;
 861         }
 862
 863         /* Find matching address that originally requested as null address. */
 864         if (address_is_static_null(in))
 865                 SET_FOREACH(a, link->addresses) {
 866                         if (!address_match_null(a, in))
 867                                 continue;
 868
 869                         if (ret)
 870                                 *ret = a;
 871                         return 0;
 872                 }
 873
 874         return -ENOENT;
 875 }
 876
 877 int address_get_harder(Link *link, const Address *in, Address **ret) {
 878         Request *req;
 879         int r;
 880
 881         assert(link);
 882         assert(in);
 883
 884         if (address_get(link, in, ret) >= 0)
 885                 return 0;
 886
 887         r = address_get_request(link, in, &req);
 888         if (r < 0)
 889                 return r;
 890
 891         if (ret)
 892                 *ret = ASSERT_PTR(req->userdata);
 893
 894         return 0;
 895 }
 896
 897 int link_get_address(Link *link, int family, const union in_addr_union *address, unsigned char prefixlen, Address **ret) {
 898         Address *a;
 899         int r;
 900
 901         assert(link);
 902         assert(IN_SET(family, AF_INET, AF_INET6));
 903         assert(address);
 904
 905         /* This find an Address object on the link which matches the given address and prefix length
 906          * and does not have peer address. When the prefixlen is zero, then an Address object with an
 907          * arbitrary prefixlen will be returned. */
 908
 909         if (family == AF_INET6 || prefixlen != 0) {
 910                 _cleanup_(address_freep) Address *tmp = NULL;
 911
 912                 /* In this case, we can use address_get(). */
 913
 914                 r = address_new(&tmp);
 915                 if (r < 0)
 916                         return r;
 917
 918                 tmp->family = family;
 919                 tmp->in_addr = *address;
 920                 tmp->prefixlen = prefixlen;
 921
 922                 r = address_get(link, tmp, &a);
 923                 if (r < 0)
 924                         return r;
 925
 926                 if (family == AF_INET6) {
 927                         /* IPv6 addresses are managed without peer address and prefix length. Hence, we need
 928                          * to check them explicitly. */
 929                         if (in_addr_is_set(family, &a->in_addr_peer))
 930                                 return -ENOENT;
 931                         if (prefixlen != 0 && a->prefixlen != prefixlen)
 932                                 return -ENOENT;
 933                 }
 934
 935                 if (ret)
 936                         *ret = a;
 937
 938                 return 0;
 939         }
 940
 941         SET_FOREACH(a, link->addresses) {
 942                 if (a->family != family)
 943                         continue;
 944
 945                 if (!in_addr_equal(family, &a->in_addr, address))
 946                         continue;
 947
 948                 if (in_addr_is_set(family, &a->in_addr_peer))
 949                         continue;
 950
 951                 if (ret)
 952                         *ret = a;
 953
 954                 return 0;
 955         }
 956
 957         return -ENOENT;
 958 }
 959
 960 int manager_get_address(Manager *manager, int family, const union in_addr_union *address, unsigned char prefixlen, Address **ret) {
 961         Link *link;
 962
 963         assert(manager);
 964         assert(IN_SET(family, AF_INET, AF_INET6));
 965         assert(address);
 966
 967         HASHMAP_FOREACH(link, manager->links_by_index) {
 968                 if (!IN_SET(link->state, LINK_STATE_CONFIGURING, LINK_STATE_CONFIGURED))
 969                         continue;
 970
 971                 if (link_get_address(link, family, address, prefixlen, ret) >= 0)
 972                         return 0;
 973         }
 974
 975         return -ENOENT;
 976 }
 977
 978 bool manager_has_address(Manager *manager, int family, const union in_addr_union *address, bool check_ready) {
 979         Address *a;
 980
 981         assert(manager);
 982         assert(IN_SET(family, AF_INET, AF_INET6));
 983         assert(address);
 984
 985         if (manager_get_address(manager, family, address, 0, &a) < 0)
 986                 return false;
 987
 988         return check_ready ? address_is_ready(a) : (address_exists(a) && address_lifetime_is_valid(a));
 989 }
 990
 991 const char* format_lifetime(char *buf, size_t l, usec_t lifetime_usec) {
 992         assert(buf);
 993         assert(l > 4);
 994
 995         if (lifetime_usec == USEC_INFINITY)
 996                 return "forever";
 997
 998         sprintf(buf, "for ");
 999         /* format_timespan() never fails */
1000         assert_se(format_timespan(buf + 4, l - 4, usec_sub_unsigned(lifetime_usec, now(CLOCK_BOOTTIME)), USEC_PER_SEC));
1001         return buf;
1002 }
1003
1004 static void log_address_debug(const Address *address, const char *str, const Link *link) {
1005         _cleanup_free_ char *state = NULL, *flags_str = NULL, *scope_str = NULL;
1006
1007         assert(address);
1008         assert(str);
1009         assert(link);
1010
1011         if (!DEBUG_LOGGING)
1012                 return;
1013
1014         (void) network_config_state_to_string_alloc(address->state, &state);
1015
1016         const char *peer = in_addr_is_set(address->family, &address->in_addr_peer) ?
1017                 IN_ADDR_TO_STRING(address->family, &address->in_addr_peer) : NULL;
1018
1019         const char *broadcast = (address->family == AF_INET && in4_addr_is_set(&address->broadcast)) ?
1020                 IN4_ADDR_TO_STRING(&address->broadcast) : NULL;
1021
1022         (void) address_flags_to_string_alloc(address->flags, address->family, &flags_str);
1023         (void) route_scope_to_string_alloc(address->scope, &scope_str);
1024
1025         log_link_debug(link, "%s %s address (%s): %s%s%s/%u%s%s (valid %s, preferred %s), flags: %s, scope: %s%s%s",
1026                        str, strna(network_config_source_to_string(address->source)), strna(state),
1027                        IN_ADDR_TO_STRING(address->family, &address->in_addr),
1028                        peer ? " peer " : "", strempty(peer), address->prefixlen,
1029                        broadcast ? " broadcast " : "", strempty(broadcast),
1030                        FORMAT_LIFETIME(address->lifetime_valid_usec),
1031                        FORMAT_LIFETIME(address->lifetime_preferred_usec),
1032                        strna(flags_str), strna(scope_str),
1033                        address->family == AF_INET ? ", label: " : "",
1034                        address->family == AF_INET ? strna(address->label) : "");
1035 }
1036
1037 static int address_set_netlink_message(const Address *address, sd_netlink_message *m, Link *link) {
1038         uint32_t flags;
1039         int r;
1040
1041         assert(address);
1042         assert(m);
1043         assert(link);
1044
1045         r = sd_rtnl_message_addr_set_prefixlen(m, address->prefixlen);
1046         if (r < 0)
1047                 return r;
1048
1049         /* On remove, only IFA_F_MANAGETEMPADDR flag for IPv6 addresses are used. But anyway, set all
1050          * flags except tentative flag here unconditionally. Without setting the flag, the template
1051          * addresses generated by kernel will not be removed automatically when the main address is
1052          * removed. */
1053         flags = address->flags & ~IFA_F_TENTATIVE;
1054         r = sd_rtnl_message_addr_set_flags(m, flags & 0xff);
1055         if (r < 0)
1056                 return r;
1057
1058         if ((flags & ~0xff) != 0) {
1059                 r = sd_netlink_message_append_u32(m, IFA_FLAGS, flags);
1060                 if (r < 0)
1061                         return r;
1062         }
1063
1064         r = netlink_message_append_in_addr_union(m, IFA_LOCAL, address->family, &address->in_addr);
1065         if (r < 0)
1066                 return r;
1067
1068         return 0;
1069 }
1070
1071 static int address_remove_handler(sd_netlink *rtnl, sd_netlink_message *m, Link *link) {
1072         int r;
1073
1074         assert(m);
1075         assert(link);
1076
1077         if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
1078                 return 0;
1079
1080         r = sd_netlink_message_get_errno(m);
1081         if (r < 0 && r != -EADDRNOTAVAIL)
1082                 log_link_message_warning_errno(link, m, r, "Could not drop address");
1083
1084         return 1;
1085 }
1086
1087 int address_remove(Address *address) {
1088         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
1089         Request *req;
1090         Link *link;
1091         int r;
1092
1093         assert(address);
1094         assert(IN_SET(address->family, AF_INET, AF_INET6));
1095         assert(address->link);
1096         assert(address->link->ifindex > 0);
1097         assert(address->link->manager);
1098         assert(address->link->manager->rtnl);
1099
1100         link = address->link;
1101
1102         log_address_debug(address, "Removing", link);
1103
1104         r = sd_rtnl_message_new_addr(link->manager->rtnl, &m, RTM_DELADDR,
1105                                      link->ifindex, address->family);
1106         if (r < 0)
1107                 return log_link_warning_errno(link, r, "Could not allocate RTM_DELADDR message: %m");
1108
1109         r = address_set_netlink_message(address, m, link);
1110         if (r < 0)
1111                 return log_link_warning_errno(link, r, "Could not set netlink attributes: %m");
1112
1113         r = netlink_call_async(link->manager->rtnl, NULL, m,
1114                                address_remove_handler,
1115                                link_netlink_destroy_callback, link);
1116         if (r < 0)
1117                 return log_link_warning_errno(link, r, "Could not send rtnetlink message: %m");
1118
1119         link_ref(link);
1120
1121         address_enter_removing(address);
1122         if (address_get_request(link, address, &req) >= 0)
1123                 address_enter_removing(req->userdata);
1124
1125         /* The operational state is determined by address state and carrier state. Hence, if we remove
1126          * an address, the operational state may be changed. */
1127         link_update_operstate(link, true);
1128         return 0;
1129 }
1130
1131 int address_remove_and_drop(Address *address) {
1132         if (!address)
1133                 return 0;
1134
1135         address_cancel_request(address);
1136
1137         if (address_exists(address))
1138                 return address_remove(address);
1139
1140         return address_drop(address);
1141 }
1142
1143 bool link_address_is_dynamic(const Link *link, const Address *address) {
1144         Route *route;
1145
1146         assert(link);
1147         assert(address);
1148
1149         if (address->lifetime_preferred_usec != USEC_INFINITY)
1150                 return true;
1151
1152         /* Even when the address is leased from a DHCP server, networkd assign the address
1153          * without lifetime when KeepConfiguration=dhcp. So, let's check that we have
1154          * corresponding routes with RTPROT_DHCP. */
1155         SET_FOREACH(route, link->routes) {
1156                 if (route->source != NETWORK_CONFIG_SOURCE_FOREIGN)
1157                         continue;
1158
1159                 /* The route is not assigned yet, or already removed. Ignoring. */
1160                 if (!route_exists(route))
1161                         continue;
1162
1163                 if (route->protocol != RTPROT_DHCP)
1164                         continue;
1165
1166                 if (address->family != route->family)
1167                         continue;
1168
1169                 if (in_addr_equal(address->family, &address->in_addr, &route->prefsrc))
1170                         return true;
1171         }
1172
1173         return false;
1174 }
1175
1176 int link_drop_ipv6ll_addresses(Link *link) {
1177         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL, *reply = NULL;
1178         int r;
1179
1180         assert(link);
1181         assert(link->manager);
1182         assert(link->manager->rtnl);
1183
1184         /* IPv6LL address may be in the tentative state, and in that case networkd has not received it.
1185          * So, we need to dump all IPv6 addresses. */
1186
1187         if (link_may_have_ipv6ll(link, /* check_multicast = */ false))
1188                 return 0;
1189
1190         r = sd_rtnl_message_new_addr(link->manager->rtnl, &req, RTM_GETADDR, link->ifindex, AF_INET6);
1191         if (r < 0)
1192                 return r;
1193
1194         r = sd_netlink_message_set_request_dump(req, true);
1195         if (r < 0)
1196                 return r;
1197
1198         r = sd_netlink_call(link->manager->rtnl, req, 0, &reply);
1199         if (r < 0)
1200                 return r;
1201
1202         for (sd_netlink_message *addr = reply; addr; addr = sd_netlink_message_next(addr)) {
1203                 _cleanup_(address_freep) Address *a = NULL;
1204                 unsigned char flags, prefixlen;
1205                 struct in6_addr address;
1206                 Address *existing;
1207                 int ifindex;
1208
1209                 /* NETLINK_GET_STRICT_CHK socket option is supported since kernel 4.20. To support
1210                  * older kernels, we need to check ifindex here. */
1211                 r = sd_rtnl_message_addr_get_ifindex(addr, &ifindex);
1212                 if (r < 0) {
1213                         log_link_debug_errno(link, r, "rtnl: received address message without valid ifindex, ignoring: %m");
1214                         continue;
1215                 } else if (link->ifindex != ifindex)
1216                         continue;
1217
1218                 r = sd_rtnl_message_addr_get_flags(addr, &flags);
1219                 if (r < 0) {
1220                         log_link_debug_errno(link, r, "rtnl: received address message without valid flags, ignoring: %m");
1221                         continue;
1222                 }
1223
1224                 r = sd_rtnl_message_addr_get_prefixlen(addr, &prefixlen);
1225                 if (r < 0) {
1226                         log_link_debug_errno(link, r, "rtnl: received address message without prefixlen, ignoring: %m");
1227                         continue;
1228                 }
1229
1230                 if (sd_netlink_message_read_in6_addr(addr, IFA_LOCAL, NULL) >= 0)
1231                         /* address with peer, ignoring. */
1232                         continue;
1233
1234                 r = sd_netlink_message_read_in6_addr(addr, IFA_ADDRESS, &address);
1235                 if (r < 0) {
1236                         log_link_debug_errno(link, r, "rtnl: received address message without valid address, ignoring: %m");
1237                         continue;
1238                 }
1239
1240                 if (!in6_addr_is_link_local(&address))
1241                          continue;
1242
1243                 r = address_new(&a);
1244                 if (r < 0)
1245                         return -ENOMEM;
1246
1247                 a->family = AF_INET6;
1248                 a->in_addr.in6 = address;
1249                 a->prefixlen = prefixlen;
1250                 a->flags = flags;
1251
1252                 if (address_get(link, a, &existing) < 0) {
1253                         r = address_add(link, a);
1254                         if (r < 0)
1255                                 return r;
1256
1257                         existing = TAKE_PTR(a);
1258                 }
1259
1260                 r = address_remove(existing);
1261                 if (r < 0)
1262                         return r;
1263         }
1264
1265         return 0;
1266 }
1267
1268 int link_drop_foreign_addresses(Link *link) {
1269         Address *address;
1270         int r = 0;
1271
1272         assert(link);
1273         assert(link->network);
1274
1275         /* First, mark all addresses. */
1276         SET_FOREACH(address, link->addresses) {
1277                 /* We consider IPv6LL addresses to be managed by the kernel, or dropped in link_drop_ipv6ll_addresses() */
1278                 if (address->family == AF_INET6 && in6_addr_is_link_local(&address->in_addr.in6))
1279                         continue;
1280
1281                 /* Do not remove localhost address (127.0.0.1 and ::1) */
1282                 if (link->flags & IFF_LOOPBACK && in_addr_is_localhost_one(address->family, &address->in_addr) > 0)
1283                         continue;
1284
1285                 /* Ignore addresses we configured. */
1286                 if (address->source != NETWORK_CONFIG_SOURCE_FOREIGN)
1287                         continue;
1288
1289                 /* Ignore addresses not assigned yet or already removing. */
1290                 if (!address_exists(address))
1291                         continue;
1292
1293                 /* link_address_is_dynamic() is slightly heavy. Let's call the function only when KeepConfiguration= is set. */
1294                 if (IN_SET(link->network->keep_configuration, KEEP_CONFIGURATION_DHCP, KEEP_CONFIGURATION_STATIC) &&
1295                     link_address_is_dynamic(link, address) == (link->network->keep_configuration == KEEP_CONFIGURATION_DHCP))
1296                         continue;
1297
1298                 address_mark(address);
1299         }
1300
1301         /* Then, unmark requested addresses. */
1302         ORDERED_HASHMAP_FOREACH(address, link->network->addresses_by_section) {
1303                 Address *existing;
1304
1305                 if (address_get(link, address, &existing) < 0)
1306                         continue;
1307
1308                 if (!address_can_update(existing, address))
1309                         continue;
1310
1311                 /* Found matching static configuration. Keep the existing address. */
1312                 address_unmark(existing);
1313         }
1314
1315         /* Finally, remove all marked addresses. */
1316         SET_FOREACH(address, link->addresses) {
1317                 if (!address_is_marked(address))
1318                         continue;
1319
1320                 RET_GATHER(r, address_remove(address));
1321         }
1322
1323         return r;
1324 }
1325
1326 int link_drop_managed_addresses(Link *link) {
1327         Address *address;
1328         int r = 0;
1329
1330         assert(link);
1331
1332         SET_FOREACH(address, link->addresses) {
1333                 /* Do not touch addresses managed by kernel or other tools. */
1334                 if (address->source == NETWORK_CONFIG_SOURCE_FOREIGN)
1335                         continue;
1336
1337                 /* Ignore addresses not assigned yet or already removing. */
1338                 if (!address_exists(address))
1339                         continue;
1340
1341                 RET_GATHER(r, address_remove(address));
1342         }
1343
1344         return r;
1345 }
1346
1347 void link_foreignize_addresses(Link *link) {
1348         Address *address;
1349
1350         assert(link);
1351
1352         SET_FOREACH(address, link->addresses)
1353                 address->source = NETWORK_CONFIG_SOURCE_FOREIGN;
1354 }
1355
1356 static int address_acquire(Link *link, const Address *original, Address **ret) {
1357         _cleanup_(address_freep) Address *na = NULL;
1358         union in_addr_union in_addr;
1359         int r;
1360
1361         assert(link);
1362         assert(original);
1363         assert(ret);
1364
1365         /* Something useful was configured? just use it */
1366         if (in_addr_is_set(original->family, &original->in_addr))
1367                 return address_dup(original, ret);
1368
1369         /* The address is configured to be 0.0.0.0 or [::] by the user?
1370          * Then let's acquire something more useful from the pool. */
1371         r = address_pool_acquire(link->manager, original->family, original->prefixlen, &in_addr);
1372         if (r < 0)
1373                 return r;
1374         if (r == 0)
1375                 return -EBUSY;
1376
1377         /* Pick first address in range for ourselves. */
1378         if (original->family == AF_INET)
1379                 in_addr.in.s_addr = in_addr.in.s_addr | htobe32(1);
1380         else if (original->family == AF_INET6)
1381                 in_addr.in6.s6_addr[15] |= 1;
1382
1383         r = address_dup(original, &na);
1384         if (r < 0)
1385                 return r;
1386
1387         na->in_addr = in_addr;
1388
1389         *ret = TAKE_PTR(na);
1390         return 0;
1391 }
1392
1393 int address_configure_handler_internal(sd_netlink *rtnl, sd_netlink_message *m, Link *link, const char *error_msg) {
1394         int r;
1395
1396         assert(rtnl);
1397         assert(m);
1398         assert(link);
1399         assert(error_msg);
1400
1401         r = sd_netlink_message_get_errno(m);
1402         if (r < 0 && r != -EEXIST) {
1403                 log_link_message_warning_errno(link, m, r, error_msg);
1404                 link_enter_failed(link);
1405                 return 0;
1406         }
1407
1408         return 1;
1409 }
1410
1411 static int address_configure(const Address *address, const struct ifa_cacheinfo *c, Link *link, Request *req) {
1412         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
1413         int r;
1414
1415         assert(address);
1416         assert(IN_SET(address->family, AF_INET, AF_INET6));
1417         assert(c);
1418         assert(link);
1419         assert(link->ifindex > 0);
1420         assert(link->manager);
1421         assert(link->manager->rtnl);
1422         assert(req);
1423
1424         log_address_debug(address, "Configuring", link);
1425
1426         r = sd_rtnl_message_new_addr_update(link->manager->rtnl, &m, link->ifindex, address->family);
1427         if (r < 0)
1428                 return r;
1429
1430         r = address_set_netlink_message(address, m, link);
1431         if (r < 0)
1432                 return r;
1433
1434         r = sd_rtnl_message_addr_set_scope(m, address->scope);
1435         if (r < 0)
1436                 return r;
1437
1438         if (address->family == AF_INET6 || in_addr_is_set(address->family, &address->in_addr_peer)) {
1439                 r = netlink_message_append_in_addr_union(m, IFA_ADDRESS, address->family, &address->in_addr_peer);
1440                 if (r < 0)
1441                         return r;
1442         } else if (in4_addr_is_set(&address->broadcast)) {
1443                 r = sd_netlink_message_append_in_addr(m, IFA_BROADCAST, &address->broadcast);
1444                 if (r < 0)
1445                         return r;
1446         }
1447
1448         if (address->family == AF_INET && address->label) {
1449                 r = sd_netlink_message_append_string(m, IFA_LABEL, address->label);
1450                 if (r < 0)
1451                         return r;
1452         }
1453
1454         r = sd_netlink_message_append_cache_info(m, IFA_CACHEINFO, c);
1455         if (r < 0)
1456                 return r;
1457
1458         r = sd_netlink_message_append_u32(m, IFA_RT_PRIORITY, address->route_metric);
1459         if (r < 0)
1460                 return r;
1461
1462         return request_call_netlink_async(link->manager->rtnl, m, req);
1463 }
1464
1465 static bool address_is_ready_to_configure(Link *link, const Address *address) {
1466         assert(link);
1467         assert(address);
1468
1469         if (!link_is_ready_to_configure(link, false))
1470                 return false;
1471
1472         if (!ipv4acd_bound(link, address))
1473                 return false;
1474
1475         /* Refuse adding more than the limit */
1476         if (set_size(link->addresses) >= ADDRESSES_PER_LINK_MAX)
1477                 return false;
1478
1479         return true;
1480 }
1481
1482 static int address_process_request(Request *req, Link *link, Address *address) {
1483         Address *existing;
1484         struct ifa_cacheinfo c;
1485         int r;
1486
1487         assert(req);
1488         assert(link);
1489         assert(address);
1490
1491         if (!address_is_ready_to_configure(link, address))
1492                 return 0;
1493
1494         address_set_cinfo(link->manager, address, &c);
1495         if (c.ifa_valid == 0) {
1496                 log_link_debug(link, "Refuse to configure %s address %s, as its valid lifetime is zero.",
1497                                network_config_source_to_string(address->source),
1498                                IN_ADDR_PREFIX_TO_STRING(address->family, &address->in_addr, address->prefixlen));
1499
1500                 address_cancel_requesting(address);
1501                 if (address_get(link, address, &existing) >= 0)
1502                         address_cancel_requesting(existing);
1503                 return 1;
1504         }
1505
1506         r = address_configure(address, &c, link, req);
1507         if (r < 0)
1508                 return log_link_warning_errno(link, r, "Failed to configure address: %m");
1509
1510         address_enter_configuring(address);
1511         if (address_get(link, address, &existing) >= 0)
1512                 address_enter_configuring(existing);
1513
1514         return 1;
1515 }
1516
1517 int link_request_address(
1518                 Link *link,
1519                 const Address *address,
1520                 unsigned *message_counter,
1521                 address_netlink_handler_t netlink_handler,
1522                 Request **ret) {
1523
1524         _cleanup_(address_freep) Address *tmp = NULL;
1525         Address *existing = NULL;
1526         int r;
1527
1528         assert(link);
1529         assert(address);
1530         assert(address->source != NETWORK_CONFIG_SOURCE_FOREIGN);
1531
1532         if (address->lifetime_valid_usec == 0)
1533                 /* The requested address is outdated. Let's ignore the request. */
1534                 return 0;
1535
1536         if (address_get(link, address, &existing) < 0) {
1537                 if (address_get_request(link, address, NULL) >= 0)
1538                         return 0; /* already requested, skipping. */
1539
1540                 r = address_acquire(link, address, &tmp);
1541                 if (r < 0)
1542                         return log_link_warning_errno(link, r, "Failed to acquire an address from pool: %m");
1543
1544                 /* Consider address tentative until we get the real flags from the kernel */
1545                 tmp->flags |= IFA_F_TENTATIVE;
1546
1547         } else {
1548                 r = address_dup(address, &tmp);
1549                 if (r < 0)
1550                         return log_oom();
1551
1552                 /* Copy already assigned address when it is requested as a null address. */
1553                 if (address_is_static_null(address))
1554                         tmp->in_addr = existing->in_addr;
1555
1556                 /* Copy state for logging below. */
1557                 tmp->state = existing->state;
1558         }
1559
1560         address_set_broadcast(tmp, link);
1561
1562         r = ipv4acd_configure(link, tmp);
1563         if (r < 0)
1564                 return r;
1565
1566         log_address_debug(tmp, "Requesting", link);
1567         r = link_queue_request_safe(link, REQUEST_TYPE_ADDRESS,
1568                                     tmp,
1569                                     address_free,
1570                                     address_hash_func,
1571                                     address_compare_func,
1572                                     address_process_request,
1573                                     message_counter, netlink_handler, ret);
1574         if (r < 0)
1575                 return log_link_warning_errno(link, r, "Failed to request address: %m");
1576         if (r == 0)
1577                 return 0;
1578
1579         address_enter_requesting(tmp);
1580         if (existing)
1581                 address_enter_requesting(existing);
1582
1583         TAKE_PTR(tmp);
1584         return 1;
1585 }
1586
1587 static int static_address_handler(sd_netlink *rtnl, sd_netlink_message *m, Request *req, Link *link, Address *address) {
1588         int r;
1589
1590         assert(link);
1591
1592         r = address_configure_handler_internal(rtnl, m, link, "Failed to set static address");
1593         if (r <= 0)
1594                 return r;
1595
1596         if (link->static_address_messages == 0) {
1597                 log_link_debug(link, "Addresses set");
1598                 link->static_addresses_configured = true;
1599                 link_check_ready(link);
1600         }
1601
1602         return 1;
1603 }
1604
1605 int link_request_static_address(Link *link, const Address *address) {
1606         assert(link);
1607         assert(address);
1608         assert(address->source == NETWORK_CONFIG_SOURCE_STATIC);
1609
1610         return link_request_address(link, address, &link->static_address_messages,
1611                                     static_address_handler, NULL);
1612 }
1613
1614 int link_request_static_addresses(Link *link) {
1615         Address *a;
1616         int r;
1617
1618         assert(link);
1619         assert(link->network);
1620
1621         link->static_addresses_configured = false;
1622
1623         ORDERED_HASHMAP_FOREACH(a, link->network->addresses_by_section) {
1624                 r = link_request_static_address(link, a);
1625                 if (r < 0)
1626                         return r;
1627         }
1628
1629         r = link_request_radv_addresses(link);
1630         if (r < 0)
1631                 return r;
1632
1633         if (link->static_address_messages == 0) {
1634                 link->static_addresses_configured = true;
1635                 link_check_ready(link);
1636         } else {
1637                 log_link_debug(link, "Setting addresses");
1638                 link_set_state(link, LINK_STATE_CONFIGURING);
1639         }
1640
1641         return 0;
1642 }
1643
1644 void address_cancel_request(Address *address) {
1645         Request req;
1646
1647         assert(address);
1648         assert(address->link);
1649
1650         if (!address_is_requesting(address))
1651                 return;
1652
1653         req = (Request) {
1654                 .link = address->link,
1655                 .type = REQUEST_TYPE_ADDRESS,
1656                 .userdata = address,
1657                 .hash_func = (hash_func_t) address_hash_func,
1658                 .compare_func = (compare_func_t) address_compare_func,
1659         };
1660
1661         request_detach(address->link->manager, &req);
1662         address_cancel_requesting(address);
1663 }
1664
1665 int manager_rtnl_process_address(sd_netlink *rtnl, sd_netlink_message *message, Manager *m) {
1666         _cleanup_(address_freep) Address *tmp = NULL;
1667         struct ifa_cacheinfo cinfo;
1668         Link *link;
1669         uint16_t type;
1670         Address *address = NULL;
1671         Request *req = NULL;
1672         bool is_new = false, update_dhcp4;
1673         int ifindex, r;
1674
1675         assert(rtnl);
1676         assert(message);
1677         assert(m);
1678
1679         if (sd_netlink_message_is_error(message)) {
1680                 r = sd_netlink_message_get_errno(message);
1681                 if (r < 0)
1682                         log_message_warning_errno(message, r, "rtnl: failed to receive address message, ignoring");
1683
1684                 return 0;
1685         }
1686
1687         r = sd_netlink_message_get_type(message, &type);
1688         if (r < 0) {
1689                 log_warning_errno(r, "rtnl: could not get message type, ignoring: %m");
1690                 return 0;
1691         } else if (!IN_SET(type, RTM_NEWADDR, RTM_DELADDR)) {
1692                 log_warning("rtnl: received unexpected message type %u when processing address, ignoring.", type);
1693                 return 0;
1694         }
1695
1696         r = sd_rtnl_message_addr_get_ifindex(message, &ifindex);
1697         if (r < 0) {
1698                 log_warning_errno(r, "rtnl: could not get ifindex from message, ignoring: %m");
1699                 return 0;
1700         } else if (ifindex <= 0) {
1701                 log_warning("rtnl: received address message with invalid ifindex %d, ignoring.", ifindex);
1702                 return 0;
1703         }
1704
1705         r = link_get_by_index(m, ifindex, &link);
1706         if (r < 0) {
1707                 /* when enumerating we might be out of sync, but we will get the address again, so just
1708                  * ignore it */
1709                 if (!m->enumerating)
1710                         log_warning("rtnl: received address for link '%d' we don't know about, ignoring.", ifindex);
1711                 return 0;
1712         }
1713
1714         r = address_new(&tmp);
1715         if (r < 0)
1716                 return log_oom();
1717
1718         /* First, read minimal information to make address_get() work below. */
1719
1720         r = sd_rtnl_message_addr_get_family(message, &tmp->family);
1721         if (r < 0) {
1722                 log_link_warning(link, "rtnl: received address message without family, ignoring.");
1723                 return 0;
1724         } else if (!IN_SET(tmp->family, AF_INET, AF_INET6)) {
1725                 log_link_debug(link, "rtnl: received address message with invalid family '%i', ignoring.", tmp->family);
1726                 return 0;
1727         }
1728
1729         r = sd_rtnl_message_addr_get_prefixlen(message, &tmp->prefixlen);
1730         if (r < 0) {
1731                 log_link_warning_errno(link, r, "rtnl: received address message without prefixlen, ignoring: %m");
1732                 return 0;
1733         }
1734
1735         switch (tmp->family) {
1736         case AF_INET:
1737                 r = sd_netlink_message_read_in_addr(message, IFA_LOCAL, &tmp->in_addr.in);
1738                 if (r < 0) {
1739                         log_link_warning_errno(link, r, "rtnl: received address message without valid address, ignoring: %m");
1740                         return 0;
1741                 }
1742
1743                 r = sd_netlink_message_read_in_addr(message, IFA_ADDRESS, &tmp->in_addr_peer.in);
1744                 if (r < 0 && r != -ENODATA) {
1745                         log_link_warning_errno(link, r, "rtnl: could not get peer address from address message, ignoring: %m");
1746                         return 0;
1747                 } else if (r >= 0) {
1748                         if (in4_addr_equal(&tmp->in_addr.in, &tmp->in_addr_peer.in))
1749                                 tmp->in_addr_peer = IN_ADDR_NULL;
1750                 }
1751
1752                 break;
1753
1754         case AF_INET6:
1755                 r = sd_netlink_message_read_in6_addr(message, IFA_LOCAL, &tmp->in_addr.in6);
1756                 if (r >= 0) {
1757                         /* Have peer address. */
1758                         r = sd_netlink_message_read_in6_addr(message, IFA_ADDRESS, &tmp->in_addr_peer.in6);
1759                         if (r < 0) {
1760                                 log_link_warning_errno(link, r, "rtnl: could not get peer address from address message, ignoring: %m");
1761                                 return 0;
1762                         }
1763                 } else if (r == -ENODATA) {
1764                         /* Does not have peer address. */
1765                         r = sd_netlink_message_read_in6_addr(message, IFA_ADDRESS, &tmp->in_addr.in6);
1766                         if (r < 0) {
1767                                 log_link_warning_errno(link, r, "rtnl: received address message without valid address, ignoring: %m");
1768                                 return 0;
1769                         }
1770                 } else {
1771                         log_link_warning_errno(link, r, "rtnl: could not get local address from address message, ignoring: %m");
1772                         return 0;
1773                 }
1774
1775                 break;
1776
1777         default:
1778                 assert_not_reached();
1779         }
1780
1781         update_dhcp4 = tmp->family == AF_INET6;
1782
1783         /* Then, find the managed Address and Request objects corresponding to the received address. */
1784         (void) address_get(link, tmp, &address);
1785         (void) address_get_request(link, tmp, &req);
1786
1787         if (type == RTM_DELADDR) {
1788                 if (address) {
1789                         address_enter_removed(address);
1790                         log_address_debug(address, "Forgetting removed", link);
1791                         (void) address_drop(address);
1792                 } else
1793                         log_address_debug(tmp, "Kernel removed unknown", link);
1794
1795                 if (req)
1796                         address_enter_removed(req->userdata);
1797
1798                 goto finalize;
1799         }
1800
1801         if (!address) {
1802                 /* If we did not know the address, then save it. */
1803                 r = address_add(link, tmp);
1804                 if (r < 0) {
1805                         log_link_warning_errno(link, r, "Failed to save received address %s, ignoring: %m",
1806                                                IN_ADDR_PREFIX_TO_STRING(tmp->family, &tmp->in_addr, tmp->prefixlen));
1807                         return 0;
1808                 }
1809                 address = TAKE_PTR(tmp);
1810
1811                 is_new = true;
1812
1813         } else {
1814                 /* Otherwise, update the managed Address object with the netlink notification. */
1815                 address->prefixlen = tmp->prefixlen;
1816                 address->in_addr_peer = tmp->in_addr_peer;
1817         }
1818
1819         /* Also update information that cannot be obtained through netlink notification. */
1820         if (req && req->waiting_reply) {
1821                 Address *a = ASSERT_PTR(req->userdata);
1822
1823                 address->source = a->source;
1824                 address->provider = a->provider;
1825                 (void) free_and_strdup_warn(&address->netlabel, a->netlabel);
1826                 nft_set_context_clear(&address->nft_set_context);
1827                 (void) nft_set_context_dup(&a->nft_set_context, &address->nft_set_context);
1828                 address->requested_as_null = a->requested_as_null;
1829                 address->callback = a->callback;
1830         }
1831
1832         /* Then, update miscellaneous info. */
1833         r = sd_rtnl_message_addr_get_scope(message, &address->scope);
1834         if (r < 0)
1835                 log_link_debug_errno(link, r, "rtnl: received address message without scope, ignoring: %m");
1836
1837         if (address->family == AF_INET) {
1838                 _cleanup_free_ char *label = NULL;
1839
1840                 r = sd_netlink_message_read_string_strdup(message, IFA_LABEL, &label);
1841                 if (r >= 0) {
1842                         if (!streq_ptr(label, link->ifname))
1843                                 free_and_replace(address->label, label);
1844                 } else if (r != -ENODATA)
1845                         log_link_debug_errno(link, r, "rtnl: could not get label from address message, ignoring: %m");
1846
1847                 r = sd_netlink_message_read_in_addr(message, IFA_BROADCAST, &address->broadcast);
1848                 if (r < 0 && r != -ENODATA)
1849                         log_link_debug_errno(link, r, "rtnl: could not get broadcast from address message, ignoring: %m");
1850         }
1851
1852         r = sd_netlink_message_read_u32(message, IFA_FLAGS, &address->flags);
1853         if (r == -ENODATA) {
1854                 unsigned char flags;
1855
1856                 /* For old kernels. */
1857                 r = sd_rtnl_message_addr_get_flags(message, &flags);
1858                 if (r >= 0)
1859                         address->flags = flags;
1860         } else if (r < 0)
1861                 log_link_debug_errno(link, r, "rtnl: failed to read IFA_FLAGS attribute, ignoring: %m");
1862
1863         r = sd_netlink_message_read_cache_info(message, IFA_CACHEINFO, &cinfo);
1864         if (r >= 0)
1865                 address_set_lifetime(m, address, &cinfo);
1866         else if (r != -ENODATA)
1867                 log_link_debug_errno(link, r, "rtnl: failed to read IFA_CACHEINFO attribute, ignoring: %m");
1868
1869         r = sd_netlink_message_read_u32(message, IFA_RT_PRIORITY, &address->route_metric);
1870         if (r < 0 && r != -ENODATA)
1871                 log_link_debug_errno(link, r, "rtnl: failed to read IFA_RT_PRIORITY attribute, ignoring: %m");
1872
1873         address_enter_configured(address);
1874         if (req)
1875                 address_enter_configured(req->userdata);
1876
1877         log_address_debug(address, is_new ? "Received new": "Received updated", link);
1878
1879         /* address_update() logs internally, so we don't need to here. */
1880         r = address_update(address);
1881         if (r < 0)
1882                 link_enter_failed(link);
1883
1884 finalize:
1885         if (update_dhcp4) {
1886                 r = dhcp4_update_ipv6_connectivity(link);
1887                 if (r < 0) {
1888                         log_link_warning_errno(link, r, "Failed to notify IPv6 connectivity to DHCPv4 client: %m");
1889                         link_enter_failed(link);
1890                 }
1891         }
1892
1893         return 1;
1894 }
1895
1896 int config_parse_broadcast(
1897                 const char *unit,
1898                 const char *filename,
1899                 unsigned line,
1900                 const char *section,
1901                 unsigned section_line,
1902                 const char *lvalue,
1903                 int ltype,
1904                 const char *rvalue,
1905                 void *data,
1906                 void *userdata) {
1907
1908         Network *network = userdata;
1909         _cleanup_(address_free_or_set_invalidp) Address *n = NULL;
1910         union in_addr_union u;
1911         int r;
1912
1913         assert(filename);
1914         assert(section);
1915         assert(lvalue);
1916         assert(rvalue);
1917         assert(data);
1918
1919         r = address_new_static(network, filename, section_line, &n);
1920         if (r == -ENOMEM)
1921                 return log_oom();
1922         if (r < 0) {
1923                 log_syntax(unit, LOG_WARNING, filename, line, r,
1924                            "Failed to allocate new address, ignoring assignment: %m");
1925                 return 0;
1926         }
1927
1928         if (isempty(rvalue)) {
1929                 /* The broadcast address will be calculated based on Address=, and set if the link is
1930                  * not a wireguard interface. Here, we do not check or set n->family. */
1931                 n->broadcast = (struct in_addr) {};
1932                 n->set_broadcast = -1;
1933                 TAKE_PTR(n);
1934                 return 0;
1935         }
1936
1937         r = parse_boolean(rvalue);
1938         if (r >= 0) {
1939                 /* The broadcast address will be calculated based on Address=. Here, we do not check or
1940                  * set n->family. */
1941                 n->broadcast = (struct in_addr) {};
1942                 n->set_broadcast = r;
1943                 TAKE_PTR(n);
1944                 return 0;
1945         }
1946
1947         if (n->family == AF_INET6) {
1948                 log_syntax(unit, LOG_WARNING, filename, line, 0,
1949                            "Broadcast is not valid for IPv6 addresses, ignoring assignment: %s", rvalue);
1950                 return 0;
1951         }
1952
1953         r = in_addr_from_string(AF_INET, rvalue, &u);
1954         if (r < 0) {
1955                 log_syntax(unit, LOG_WARNING, filename, line, r,
1956                            "Broadcast is invalid, ignoring assignment: %s", rvalue);
1957                 return 0;
1958         }
1959         if (in4_addr_is_null(&u.in)) {
1960                 log_syntax(unit, LOG_WARNING, filename, line, 0,
1961                            "Broadcast cannot be ANY address, ignoring assignment: %s", rvalue);
1962                 return 0;
1963         }
1964
1965         n->broadcast = u.in;
1966         n->set_broadcast = true;
1967         n->family = AF_INET;
1968         TAKE_PTR(n);
1969
1970         return 0;
1971 }
1972
1973 int config_parse_address(
1974                 const char *unit,
1975                 const char *filename,
1976                 unsigned line,
1977                 const char *section,
1978                 unsigned section_line,
1979                 const char *lvalue,
1980                 int ltype,
1981                 const char *rvalue,
1982                 void *data,
1983                 void *userdata) {
1984
1985         Network *network = userdata;
1986         _cleanup_(address_free_or_set_invalidp) Address *n = NULL;
1987         union in_addr_union buffer;
1988         unsigned char prefixlen;
1989         int r, f;
1990
1991         assert(filename);
1992         assert(section);
1993         assert(lvalue);
1994         assert(rvalue);
1995         assert(data);
1996
1997         if (streq(section, "Network"))
1998                 /* we are not in an Address section, so use line number instead. */
1999                 r = address_new_static(network, filename, line, &n);
2000         else
2001                 r = address_new_static(network, filename, section_line, &n);
2002         if (r == -ENOMEM)
2003                 return log_oom();
2004         if (r < 0) {
2005                 log_syntax(unit, LOG_WARNING, filename, line, r,
2006                            "Failed to allocate new address, ignoring assignment: %m");
2007                 return 0;
2008         }
2009
2010         /* Address=address/prefixlen */
2011         r = in_addr_prefix_from_string_auto_internal(rvalue, PREFIXLEN_REFUSE, &f, &buffer, &prefixlen);
2012         if (r == -ENOANO) {
2013                 r = in_addr_prefix_from_string_auto(rvalue, &f, &buffer, &prefixlen);
2014                 if (r >= 0)
2015                         log_syntax(unit, LOG_WARNING, filename, line, r,
2016                                    "Address '%s' is specified without prefix length. Assuming the prefix length is %u. "
2017                                    "Please specify the prefix length explicitly.", rvalue, prefixlen);
2018         }
2019         if (r < 0) {
2020                 log_syntax(unit, LOG_WARNING, filename, line, r, "Invalid address '%s', ignoring assignment: %m", rvalue);
2021                 return 0;
2022         }
2023
2024         if (n->family != AF_UNSPEC && f != n->family) {
2025                 log_syntax(unit, LOG_WARNING, filename, line, 0, "Address is incompatible, ignoring assignment: %s", rvalue);
2026                 return 0;
2027         }
2028
2029         if (in_addr_is_null(f, &buffer)) {
2030                 /* Will use address from address pool. Note that for ipv6 case, prefix of the address
2031                  * pool is 8, but 40 bit is used by the global ID and 16 bit by the subnet ID. So,
2032                  * let's limit the prefix length to 64 or larger. See RFC4193. */
2033                 if ((f == AF_INET && prefixlen < 8) ||
2034                     (f == AF_INET6 && prefixlen < 64)) {
2035                         log_syntax(unit, LOG_WARNING, filename, line, 0,
2036                                    "Null address with invalid prefixlen='%u', ignoring assignment: %s",
2037                                    prefixlen, rvalue);
2038                         return 0;
2039                 }
2040         }
2041
2042         n->family = f;
2043         n->prefixlen = prefixlen;
2044
2045         if (streq(lvalue, "Address")) {
2046                 n->in_addr = buffer;
2047                 n->requested_as_null = !in_addr_is_set(n->family, &n->in_addr);
2048         } else
2049                 n->in_addr_peer = buffer;
2050
2051         TAKE_PTR(n);
2052         return 0;
2053 }
2054
2055 int config_parse_label(
2056                 const char *unit,
2057                 const char *filename,
2058                 unsigned line,
2059                 const char *section,
2060                 unsigned section_line,
2061                 const char *lvalue,
2062                 int ltype,
2063                 const char *rvalue,
2064                 void *data,
2065                 void *userdata) {
2066
2067         _cleanup_(address_free_or_set_invalidp) Address *n = NULL;
2068         Network *network = userdata;
2069         int r;
2070
2071         assert(filename);
2072         assert(section);
2073         assert(lvalue);
2074         assert(rvalue);
2075         assert(data);
2076
2077         r = address_new_static(network, filename, section_line, &n);
2078         if (r == -ENOMEM)
2079                 return log_oom();
2080         if (r < 0) {
2081                 log_syntax(unit, LOG_WARNING, filename, line, r,
2082                            "Failed to allocate new address, ignoring assignment: %m");
2083                 return 0;
2084         }
2085
2086         if (isempty(rvalue)) {
2087                 n->label = mfree(n->label);
2088                 TAKE_PTR(n);
2089                 return 0;
2090         }
2091
2092         if (!address_label_valid(rvalue)) {
2093                 log_syntax(unit, LOG_WARNING, filename, line, 0,
2094                            "Interface label is too long or invalid, ignoring assignment: %s", rvalue);
2095                 return 0;
2096         }
2097
2098         r = free_and_strdup(&n->label, rvalue);
2099         if (r < 0)
2100                 return log_oom();
2101
2102         TAKE_PTR(n);
2103         return 0;
2104 }
2105
2106 int config_parse_lifetime(
2107                 const char *unit,
2108                 const char *filename,
2109                 unsigned line,
2110                 const char *section,
2111                 unsigned section_line,
2112                 const char *lvalue,
2113                 int ltype,
2114                 const char *rvalue,
2115                 void *data,
2116                 void *userdata) {
2117
2118         Network *network = userdata;
2119         _cleanup_(address_free_or_set_invalidp) Address *n = NULL;
2120         usec_t k;
2121         int r;
2122
2123         assert(filename);
2124         assert(section);
2125         assert(lvalue);
2126         assert(rvalue);
2127         assert(data);
2128
2129         r = address_new_static(network, filename, section_line, &n);
2130         if (r == -ENOMEM)
2131                 return log_oom();
2132         if (r < 0) {
2133                 log_syntax(unit, LOG_WARNING, filename, line, r,
2134                            "Failed to allocate new address, ignoring assignment: %m");
2135                 return 0;
2136         }
2137
2138         /* We accept only "forever", "infinity", empty, or "0". */
2139         if (STR_IN_SET(rvalue, "forever", "infinity", ""))
2140                 k = USEC_INFINITY;
2141         else if (streq(rvalue, "0"))
2142                 k = 0;
2143         else {
2144                 log_syntax(unit, LOG_WARNING, filename, line, 0,
2145                            "Invalid PreferredLifetime= value, ignoring: %s", rvalue);
2146                 return 0;
2147         }
2148
2149         n->lifetime_preferred_usec = k;
2150         TAKE_PTR(n);
2151
2152         return 0;
2153 }
2154
2155 int config_parse_address_flags(
2156                 const char *unit,
2157                 const char *filename,
2158                 unsigned line,
2159                 const char *section,
2160                 unsigned section_line,
2161                 const char *lvalue,
2162                 int ltype,
2163                 const char *rvalue,
2164                 void *data,
2165                 void *userdata) {
2166
2167         Network *network = userdata;
2168         _cleanup_(address_free_or_set_invalidp) Address *n = NULL;
2169         int r;
2170
2171         assert(filename);
2172         assert(section);
2173         assert(lvalue);
2174         assert(rvalue);
2175         assert(data);
2176
2177         r = address_new_static(network, filename, section_line, &n);
2178         if (r == -ENOMEM)
2179                 return log_oom();
2180         if (r < 0) {
2181                 log_syntax(unit, LOG_WARNING, filename, line, r,
2182                            "Failed to allocate new address, ignoring assignment: %m");
2183                 return 0;
2184         }
2185
2186         r = parse_boolean(rvalue);
2187         if (r < 0) {
2188                 log_syntax(unit, LOG_WARNING, filename, line, r,
2189                            "Failed to parse %s=, ignoring: %s", lvalue, rvalue);
2190                 return 0;
2191         }
2192
2193         if (streq(lvalue, "AddPrefixRoute"))
2194                 r = !r;
2195
2196         SET_FLAG(n->flags, ltype, r);
2197
2198         TAKE_PTR(n);
2199         return 0;
2200 }
2201
2202 int config_parse_address_scope(
2203                 const char *unit,
2204                 const char *filename,
2205                 unsigned line,
2206                 const char *section,
2207                 unsigned section_line,
2208                 const char *lvalue,
2209                 int ltype,
2210                 const char *rvalue,
2211                 void *data,
2212                 void *userdata) {
2213
2214         Network *network = userdata;
2215         _cleanup_(address_free_or_set_invalidp) Address *n = NULL;
2216         int r;
2217
2218         assert(filename);
2219         assert(section);
2220         assert(lvalue);
2221         assert(rvalue);
2222         assert(data);
2223
2224         r = address_new_static(network, filename, section_line, &n);
2225         if (r == -ENOMEM)
2226                 return log_oom();
2227         if (r < 0) {
2228                 log_syntax(unit, LOG_WARNING, filename, line, r,
2229                            "Failed to allocate new address, ignoring assignment: %m");
2230                 return 0;
2231         }
2232
2233         r = route_scope_from_string(rvalue);
2234         if (r < 0) {
2235                 log_syntax(unit, LOG_WARNING, filename, line, r,
2236                            "Could not parse address scope \"%s\", ignoring assignment: %m", rvalue);
2237                 return 0;
2238         }
2239
2240         n->scope = r;
2241         n->scope_set = true;
2242         TAKE_PTR(n);
2243         return 0;
2244 }
2245
2246 int config_parse_address_route_metric(
2247                 const char *unit,
2248                 const char *filename,
2249                 unsigned line,
2250                 const char *section,
2251                 unsigned section_line,
2252                 const char *lvalue,
2253                 int ltype,
2254                 const char *rvalue,
2255                 void *data,
2256                 void *userdata) {
2257
2258         Network *network = userdata;
2259         _cleanup_(address_free_or_set_invalidp) Address *n = NULL;
2260         int r;
2261
2262         assert(filename);
2263         assert(section);
2264         assert(lvalue);
2265         assert(rvalue);
2266         assert(data);
2267
2268         r = address_new_static(network, filename, section_line, &n);
2269         if (r == -ENOMEM)
2270                 return log_oom();
2271         if (r < 0) {
2272                 log_syntax(unit, LOG_WARNING, filename, line, r,
2273                            "Failed to allocate new address, ignoring assignment: %m");
2274                 return 0;
2275         }
2276
2277         r = safe_atou32(rvalue, &n->route_metric);
2278         if (r < 0) {
2279                 log_syntax(unit, LOG_WARNING, filename, line, r,
2280                            "Could not parse %s=, ignoring assignment: %s", lvalue, rvalue);
2281                 return 0;
2282         }
2283
2284         TAKE_PTR(n);
2285         return 0;
2286 }
2287
2288 int config_parse_duplicate_address_detection(
2289                 const char *unit,
2290                 const char *filename,
2291                 unsigned line,
2292                 const char *section,
2293                 unsigned section_line,
2294                 const char *lvalue,
2295                 int ltype,
2296                 const char *rvalue,
2297                 void *data,
2298                 void *userdata) {
2299
2300         Network *network = userdata;
2301         _cleanup_(address_free_or_set_invalidp) Address *n = NULL;
2302         int r;
2303
2304         assert(filename);
2305         assert(section);
2306         assert(lvalue);
2307         assert(rvalue);
2308         assert(data);
2309
2310         r = address_new_static(network, filename, section_line, &n);
2311         if (r == -ENOMEM)
2312                 return log_oom();
2313         if (r < 0) {
2314                 log_syntax(unit, LOG_WARNING, filename, line, r,
2315                            "Failed to allocate new address, ignoring assignment: %m");
2316                 return 0;
2317         }
2318
2319         r = parse_boolean(rvalue);
2320         if (r >= 0) {
2321                 log_syntax(unit, LOG_WARNING, filename, line, 0,
2322                            "For historical reasons, %s=%s means %s=%s. "
2323                            "Please use 'both', 'ipv4', 'ipv6' or 'none' instead.",
2324                            lvalue, rvalue, lvalue, r ? "none" : "both");
2325                 n->duplicate_address_detection = r ? ADDRESS_FAMILY_NO : ADDRESS_FAMILY_YES;
2326                 n = NULL;
2327                 return 0;
2328         }
2329
2330         AddressFamily a = duplicate_address_detection_address_family_from_string(rvalue);
2331         if (a < 0) {
2332                 log_syntax(unit, LOG_WARNING, filename, line, a,
2333                            "Failed to parse %s=, ignoring: %s", lvalue, rvalue);
2334                 return 0;
2335         }
2336         n->duplicate_address_detection = a;
2337
2338         TAKE_PTR(n);
2339         return 0;
2340 }
2341
2342 int config_parse_address_netlabel(
2343                 const char *unit,
2344                 const char *filename,
2345                 unsigned line,
2346                 const char *section,
2347                 unsigned section_line,
2348                 const char *lvalue,
2349                 int ltype,
2350                 const char *rvalue,
2351                 void *data,
2352                 void *userdata) {
2353
2354         Network *network = userdata;
2355         _cleanup_(address_free_or_set_invalidp) Address *n = NULL;
2356         int r;
2357
2358         assert(filename);
2359         assert(section);
2360         assert(lvalue);
2361         assert(rvalue);
2362         assert(data);
2363         assert(network);
2364
2365         r = address_new_static(network, filename, section_line, &n);
2366         if (r == -ENOMEM)
2367                 return log_oom();
2368         if (r < 0) {
2369                 log_syntax(unit, LOG_WARNING, filename, line, r,
2370                            "Failed to allocate new address, ignoring assignment: %m");
2371                 return 0;
2372         }
2373
2374         r = config_parse_string(unit, filename, line, section, section_line,
2375                                 lvalue, CONFIG_PARSE_STRING_SAFE, rvalue, &n->netlabel, network);
2376         if (r < 0)
2377                 return r;
2378
2379         TAKE_PTR(n);
2380         return 0;
2381 }
2382
2383 static void address_section_adjust_broadcast(Address *address) {
2384         assert(address);
2385         assert(address->section);
2386
2387         if (!in4_addr_is_set(&address->broadcast))
2388                 return;
2389
2390         if (address->family == AF_INET6)
2391                 log_warning("%s: broadcast address is set for an IPv6 address. "
2392                             "Ignoring Broadcast= setting in the [Address] section from line %u.",
2393                             address->section->filename, address->section->line);
2394         else if (address->prefixlen > 30)
2395                 log_warning("%s: broadcast address is set for an IPv4 address with prefix length larger than 30. "
2396                             "Ignoring Broadcast= setting in the [Address] section from line %u.",
2397                             address->section->filename, address->section->line);
2398         else if (in4_addr_is_set(&address->in_addr_peer.in))
2399                 log_warning("%s: broadcast address is set for an IPv4 address with peer address. "
2400                             "Ignoring Broadcast= setting in the [Address] section from line %u.",
2401                             address->section->filename, address->section->line);
2402         else if (!in4_addr_is_set(&address->in_addr.in))
2403                 log_warning("%s: broadcast address is set for an IPv4 address with null address. "
2404                             "Ignoring Broadcast= setting in the [Address] section from line %u.",
2405                             address->section->filename, address->section->line);
2406         else
2407                 /* Otherwise, keep the specified broadcast address. */
2408                 return;
2409
2410         address->broadcast.s_addr = 0;
2411 }
2412
2413 int address_section_verify(Address *address) {
2414         if (section_is_invalid(address->section))
2415                 return -EINVAL;
2416
2417         if (address->family == AF_UNSPEC) {
2418                 assert(address->section);
2419
2420                 return log_warning_errno(SYNTHETIC_ERRNO(EINVAL),
2421                                          "%s: Address section without Address= field was configured. "
2422                                          "Ignoring [Address] section from line %u.",
2423                                          address->section->filename, address->section->line);
2424         }
2425
2426         if (address->family == AF_INET6 && !socket_ipv6_is_supported())
2427                 return log_warning_errno(SYNTHETIC_ERRNO(EINVAL),
2428                                          "%s: an IPv6 address was configured, but the kernel does not support IPv6. "
2429                                          "Ignoring [Address] section from line %u.",
2430                                          address->section->filename, address->section->line);
2431
2432         assert(IN_SET(address->family, AF_INET, AF_INET6));
2433
2434         address_section_adjust_broadcast(address);
2435
2436         if (address->family == AF_INET6 && address->label) {
2437                 log_warning("%s: address label is set for IPv6 address in the [Address] section from line %u. "
2438                             "Ignoring Label= setting.",
2439                             address->section->filename, address->section->line);
2440
2441                 address->label = mfree(address->label);
2442         }
2443
2444         if (!address->scope_set) {
2445                 if (in_addr_is_localhost(address->family, &address->in_addr) > 0)
2446                         address->scope = RT_SCOPE_HOST;
2447                 else if (in_addr_is_link_local(address->family, &address->in_addr) > 0)
2448                         address->scope = RT_SCOPE_LINK;
2449         }
2450
2451         if (address->duplicate_address_detection < 0) {
2452                 if (address->family == AF_INET6)
2453                         address->duplicate_address_detection = ADDRESS_FAMILY_IPV6;
2454                 else if (in4_addr_is_link_local(&address->in_addr.in))
2455                         address->duplicate_address_detection = ADDRESS_FAMILY_IPV4;
2456                 else
2457                         address->duplicate_address_detection = ADDRESS_FAMILY_NO;
2458         } else if (address->duplicate_address_detection == ADDRESS_FAMILY_IPV6 && address->family == AF_INET)
2459                 log_warning("%s: DuplicateAddressDetection=ipv6 is specified for IPv4 address, ignoring.",
2460                             address->section->filename);
2461         else if (address->duplicate_address_detection == ADDRESS_FAMILY_IPV4 && address->family == AF_INET6)
2462                 log_warning("%s: DuplicateAddressDetection=ipv4 is specified for IPv6 address, ignoring.",
2463                             address->section->filename);
2464
2465         if (address->family == AF_INET6 &&
2466             !FLAGS_SET(address->duplicate_address_detection, ADDRESS_FAMILY_IPV6))
2467                 address->flags |= IFA_F_NODAD;
2468
2469         uint32_t filtered_flags = address->family == AF_INET ?
2470                 address->flags & KNOWN_FLAGS & ~UNMANAGED_FLAGS & ~IPV6ONLY_FLAGS :
2471                 address->flags & KNOWN_FLAGS & ~UNMANAGED_FLAGS;
2472         if (address->flags != filtered_flags) {
2473                 _cleanup_free_ char *str = NULL;
2474
2475                 (void) address_flags_to_string_alloc(address->flags ^ filtered_flags, address->family, &str);
2476                 return log_warning_errno(SYNTHETIC_ERRNO(EINVAL),
2477                                          "%s: unexpected address flags \"%s\" were configured. "
2478                                          "Ignoring [Address] section from line %u.",
2479                                          address->section->filename, strna(str), address->section->line);
2480         }
2481
2482         return 0;
2483 }
2484
2485 int network_drop_invalid_addresses(Network *network) {
2486         _cleanup_set_free_ Set *addresses = NULL;
2487         Address *address;
2488         int r;
2489
2490         assert(network);
2491
2492         ORDERED_HASHMAP_FOREACH(address, network->addresses_by_section) {
2493                 Address *dup;
2494
2495                 if (address_section_verify(address) < 0) {
2496                         /* Drop invalid [Address] sections or Address= settings in [Network].
2497                          * Note that address_free() will drop the address from addresses_by_section. */
2498                         address_free(address);
2499                         continue;
2500                 }
2501
2502                 /* Always use the setting specified later. So, remove the previously assigned setting. */
2503                 dup = set_remove(addresses, address);
2504                 if (dup) {
2505                         log_warning("%s: Duplicated address %s is specified at line %u and %u, "
2506                                     "dropping the address setting specified at line %u.",
2507                                     dup->section->filename,
2508                                     IN_ADDR_PREFIX_TO_STRING(address->family, &address->in_addr, address->prefixlen),
2509                                     address->section->line,
2510                                     dup->section->line, dup->section->line);
2511                         /* address_free() will drop the address from addresses_by_section. */
2512                         address_free(dup);
2513                 }
2514
2515                 /* Use address_hash_ops, instead of address_hash_ops_free. Otherwise, the Address objects
2516                  * will be freed. */
2517                 r = set_ensure_put(&addresses, &address_hash_ops, address);
2518                 if (r < 0)
2519                         return log_oom();
2520                 assert(r > 0);
2521         }
2522
2523         r = network_adjust_dhcp_server(network, &addresses);
2524         if (r < 0)
2525                 return r;
2526
2527         return 0;
2528 }
2529
2530 int config_parse_address_ip_nft_set(
2531                 const char *unit,
2532                 const char *filename,
2533                 unsigned line,
2534                 const char *section,
2535                 unsigned section_line,
2536                 const char *lvalue,
2537                 int ltype,
2538                 const char *rvalue,
2539                 void *data,
2540                 void *userdata) {
2541
2542         Network *network = userdata;
2543         _cleanup_(address_free_or_set_invalidp) Address *n = NULL;
2544         int r;
2545
2546         assert(filename);
2547         assert(lvalue);
2548         assert(rvalue);
2549         assert(network);
2550
2551         r = address_new_static(network, filename, section_line, &n);
2552         if (r == -ENOMEM)
2553                 return log_oom();
2554         if (r < 0) {
2555                 log_syntax(unit, LOG_WARNING, filename, line, r,
2556                            "Failed to allocate a new address, ignoring assignment: %m");
2557                 return 0;
2558         }
2559
2560         r = config_parse_nft_set(unit, filename, line, section, section_line, lvalue, ltype, rvalue, &n->nft_set_context, network);
2561         if (r < 0)
2562                 return r;
2563
2564         TAKE_PTR(n);
2565         return 0;
2566 }