src/nspawn/nspawn-network.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <net/if.h>
   4 #include <linux/if.h>
   5 #include <linux/veth.h>
   6 #include <sys/file.h>
   7
   8 #include "sd-device.h"
   9 #include "sd-id128.h"
  10 #include "sd-netlink.h"
  11
  12 #include "alloc-util.h"
  13 #include "ether-addr-util.h"
  14 #include "hexdecoct.h"
  15 #include "lockfile-util.h"
  16 #include "missing_network.h"
  17 #include "netif-naming-scheme.h"
  18 #include "netlink-util.h"
  19 #include "nspawn-network.h"
  20 #include "parse-util.h"
  21 #include "siphash24.h"
  22 #include "socket-netlink.h"
  23 #include "socket-util.h"
  24 #include "stat-util.h"
  25 #include "string-util.h"
  26 #include "strv.h"
  27 #include "udev-util.h"
  28 #include "util.h"
  29
  30 #define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
  31 #define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
  32 #define VETH_EXTRA_HOST_HASH_KEY SD_ID128_MAKE(48,c7,f6,b7,ea,9d,4c,9e,b7,28,d4,de,91,d5,bf,66)
  33 #define VETH_EXTRA_CONTAINER_HASH_KEY SD_ID128_MAKE(af,50,17,61,ce,f9,4d,35,84,0d,2b,20,54,be,ce,59)
  34 #define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)
  35 #define SHORTEN_IFNAME_HASH_KEY SD_ID128_MAKE(e1,90,a4,04,a8,ef,4b,51,8c,cc,c3,3a,9f,11,fc,a2)
  36
  37 static int remove_one_link(sd_netlink *rtnl, const char *name) {
  38         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
  39         int r;
  40
  41         if (isempty(name))
  42                 return 0;
  43
  44         r = sd_rtnl_message_new_link(rtnl, &m, RTM_DELLINK, 0);
  45         if (r < 0)
  46                 return log_error_errno(r, "Failed to allocate netlink message: %m");
  47
  48         r = sd_netlink_message_append_string(m, IFLA_IFNAME, name);
  49         if (r < 0)
  50                 return log_error_errno(r, "Failed to add netlink interface name: %m");
  51
  52         r = sd_netlink_call(rtnl, m, 0, NULL);
  53         if (r == -ENODEV) /* Already gone */
  54                 return 0;
  55         if (r < 0)
  56                 return log_error_errno(r, "Failed to remove interface %s: %m", name);
  57
  58         return 1;
  59 }
  60
  61 static int generate_mac(
  62                 const char *machine_name,
  63                 struct ether_addr *mac,
  64                 sd_id128_t hash_key,
  65                 uint64_t idx) {
  66
  67         uint64_t result;
  68         size_t l, sz;
  69         uint8_t *v, *i;
  70         int r;
  71
  72         l = strlen(machine_name);
  73         sz = sizeof(sd_id128_t) + l;
  74         if (idx > 0)
  75                 sz += sizeof(idx);
  76
  77         v = newa(uint8_t, sz);
  78
  79         /* fetch some persistent data unique to the host */
  80         r = sd_id128_get_machine((sd_id128_t*) v);
  81         if (r < 0)
  82                 return r;
  83
  84         /* combine with some data unique (on this host) to this
  85          * container instance */
  86         i = mempcpy(v + sizeof(sd_id128_t), machine_name, l);
  87         if (idx > 0) {
  88                 idx = htole64(idx);
  89                 memcpy(i, &idx, sizeof(idx));
  90         }
  91
  92         /* Let's hash the host machine ID plus the container name. We
  93          * use a fixed, but originally randomly created hash key here. */
  94         result = htole64(siphash24(v, sz, hash_key.bytes));
  95
  96         assert_cc(ETH_ALEN <= sizeof(result));
  97         memcpy(mac->ether_addr_octet, &result, ETH_ALEN);
  98
  99         /* see eth_random_addr in the kernel */
 100         mac->ether_addr_octet[0] &= 0xfe;        /* clear multicast bit */
 101         mac->ether_addr_octet[0] |= 0x02;        /* set local assignment bit (IEEE802) */
 102
 103         return 0;
 104 }
 105
 106 static int set_alternative_ifname(sd_netlink *rtnl, const char *ifname, const char *altifname) {
 107         int r;
 108
 109         assert(rtnl);
 110         assert(ifname);
 111
 112         if (!altifname)
 113                 return 0;
 114
 115         if (strlen(altifname) >= ALTIFNAMSIZ)
 116                 return log_warning_errno(SYNTHETIC_ERRNO(ERANGE),
 117                                          "Alternative interface name '%s' for '%s' is too long, ignoring",
 118                                          altifname, ifname);
 119
 120         r = rtnl_set_link_alternative_names_by_ifname(&rtnl, ifname, STRV_MAKE(altifname));
 121         if (r < 0)
 122                 return log_warning_errno(r,
 123                                          "Failed to set alternative interface name '%s' to '%s', ignoring: %m",
 124                                          altifname, ifname);
 125
 126         return 0;
 127 }
 128
 129 static int add_veth(
 130                 sd_netlink *rtnl,
 131                 pid_t pid,
 132                 const char *ifname_host,
 133                 const char *altifname_host,
 134                 const struct ether_addr *mac_host,
 135                 const char *ifname_container,
 136                 const struct ether_addr *mac_container) {
 137
 138         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 139         int r;
 140
 141         assert(rtnl);
 142         assert(ifname_host);
 143         assert(mac_host);
 144         assert(ifname_container);
 145         assert(mac_container);
 146
 147         r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 148         if (r < 0)
 149                 return log_error_errno(r, "Failed to allocate netlink message: %m");
 150
 151         r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_host);
 152         if (r < 0)
 153                 return log_error_errno(r, "Failed to add netlink interface name: %m");
 154
 155         r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_host);
 156         if (r < 0)
 157                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
 158
 159         r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 160         if (r < 0)
 161                 return log_error_errno(r, "Failed to open netlink container: %m");
 162
 163         r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "veth");
 164         if (r < 0)
 165                 return log_error_errno(r, "Failed to open netlink container: %m");
 166
 167         r = sd_netlink_message_open_container(m, VETH_INFO_PEER);
 168         if (r < 0)
 169                 return log_error_errno(r, "Failed to open netlink container: %m");
 170
 171         r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_container);
 172         if (r < 0)
 173                 return log_error_errno(r, "Failed to add netlink interface name: %m");
 174
 175         r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_container);
 176         if (r < 0)
 177                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
 178
 179         r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 180         if (r < 0)
 181                 return log_error_errno(r, "Failed to add netlink namespace field: %m");
 182
 183         r = sd_netlink_message_close_container(m);
 184         if (r < 0)
 185                 return log_error_errno(r, "Failed to close netlink container: %m");
 186
 187         r = sd_netlink_message_close_container(m);
 188         if (r < 0)
 189                 return log_error_errno(r, "Failed to close netlink container: %m");
 190
 191         r = sd_netlink_message_close_container(m);
 192         if (r < 0)
 193                 return log_error_errno(r, "Failed to close netlink container: %m");
 194
 195         r = sd_netlink_call(rtnl, m, 0, NULL);
 196         if (r < 0)
 197                 return log_error_errno(r, "Failed to add new veth interfaces (%s:%s): %m", ifname_host, ifname_container);
 198
 199         (void) set_alternative_ifname(rtnl, ifname_host, altifname_host);
 200
 201         return 0;
 202 }
 203
 204 static int shorten_ifname(char *ifname) {
 205         char new_ifname[IFNAMSIZ];
 206
 207         assert(ifname);
 208
 209         if (strlen(ifname) < IFNAMSIZ) /* Name is short enough */
 210                 return 0;
 211
 212         if (naming_scheme_has(NAMING_NSPAWN_LONG_HASH)) {
 213                 uint64_t h;
 214
 215                 /* Calculate 64bit hash value */
 216                 h = siphash24(ifname, strlen(ifname), SHORTEN_IFNAME_HASH_KEY.bytes);
 217
 218                 /* Set the final four bytes (i.e. 32bit) to the lower 24bit of the hash, encoded in url-safe base64 */
 219                 memcpy(new_ifname, ifname, IFNAMSIZ - 5);
 220                 new_ifname[IFNAMSIZ - 5] = urlsafe_base64char(h >> 18);
 221                 new_ifname[IFNAMSIZ - 4] = urlsafe_base64char(h >> 12);
 222                 new_ifname[IFNAMSIZ - 3] = urlsafe_base64char(h >> 6);
 223                 new_ifname[IFNAMSIZ - 2] = urlsafe_base64char(h);
 224         } else
 225                 /* On old nspawn versions we just truncated the name, provide compatibility */
 226                 memcpy(new_ifname, ifname, IFNAMSIZ-1);
 227
 228         new_ifname[IFNAMSIZ - 1] = 0;
 229
 230         /* Log the incident to make it more discoverable */
 231         log_warning("Network interface name '%s' has been changed to '%s' to fit length constraints.", ifname, new_ifname);
 232
 233         strcpy(ifname, new_ifname);
 234         return 1;
 235 }
 236
 237 int setup_veth(const char *machine_name,
 238                pid_t pid,
 239                char iface_name[IFNAMSIZ],
 240                bool bridge) {
 241
 242         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 243         struct ether_addr mac_host, mac_container;
 244         unsigned u;
 245         char *n, *a = NULL;
 246         int r;
 247
 248         assert(machine_name);
 249         assert(pid > 0);
 250         assert(iface_name);
 251
 252         /* Use two different interface name prefixes depending whether
 253          * we are in bridge mode or not. */
 254         n = strjoina(bridge ? "vb-" : "ve-", machine_name);
 255         r = shorten_ifname(n);
 256         if (r > 0)
 257                 a = strjoina(bridge ? "vb-" : "ve-", machine_name);
 258
 259         r = generate_mac(machine_name, &mac_container, CONTAINER_HASH_KEY, 0);
 260         if (r < 0)
 261                 return log_error_errno(r, "Failed to generate predictable MAC address for container side: %m");
 262
 263         r = generate_mac(machine_name, &mac_host, HOST_HASH_KEY, 0);
 264         if (r < 0)
 265                 return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");
 266
 267         r = sd_netlink_open(&rtnl);
 268         if (r < 0)
 269                 return log_error_errno(r, "Failed to connect to netlink: %m");
 270
 271         r = add_veth(rtnl, pid, n, a, &mac_host, "host0", &mac_container);
 272         if (r < 0)
 273                 return r;
 274
 275         u = if_nametoindex(n); /* We don't need to use resolve_ifname() here because the
 276                                 * name we assigned is always the main name. */
 277         if (u == 0)
 278                 return log_error_errno(errno, "Failed to resolve interface %s: %m", n);
 279
 280         strcpy(iface_name, n);
 281         return (int) u;
 282 }
 283
 284 int setup_veth_extra(
 285                 const char *machine_name,
 286                 pid_t pid,
 287                 char **pairs) {
 288
 289         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 290         uint64_t idx = 0;
 291         char **a, **b;
 292         int r;
 293
 294         assert(machine_name);
 295         assert(pid > 0);
 296
 297         if (strv_isempty(pairs))
 298                 return 0;
 299
 300         r = sd_netlink_open(&rtnl);
 301         if (r < 0)
 302                 return log_error_errno(r, "Failed to connect to netlink: %m");
 303
 304         STRV_FOREACH_PAIR(a, b, pairs) {
 305                 struct ether_addr mac_host, mac_container;
 306
 307                 r = generate_mac(machine_name, &mac_container, VETH_EXTRA_CONTAINER_HASH_KEY, idx);
 308                 if (r < 0)
 309                         return log_error_errno(r, "Failed to generate predictable MAC address for container side of extra veth link: %m");
 310
 311                 r = generate_mac(machine_name, &mac_host, VETH_EXTRA_HOST_HASH_KEY, idx);
 312                 if (r < 0)
 313                         return log_error_errno(r, "Failed to generate predictable MAC address for host side of extra veth link: %m");
 314
 315                 r = add_veth(rtnl, pid, *a, NULL, &mac_host, *b, &mac_container);
 316                 if (r < 0)
 317                         return r;
 318
 319                 idx++;
 320         }
 321
 322         return 0;
 323 }
 324
 325 static int join_bridge(sd_netlink *rtnl, const char *veth_name, const char *bridge_name) {
 326         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 327         int r, bridge_ifi;
 328
 329         assert(rtnl);
 330         assert(veth_name);
 331         assert(bridge_name);
 332
 333         bridge_ifi = resolve_interface(&rtnl, bridge_name);
 334         if (bridge_ifi < 0)
 335                 return bridge_ifi;
 336
 337         r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
 338         if (r < 0)
 339                 return r;
 340
 341         r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
 342         if (r < 0)
 343                 return r;
 344
 345         r = sd_netlink_message_append_string(m, IFLA_IFNAME, veth_name);
 346         if (r < 0)
 347                 return r;
 348
 349         r = sd_netlink_message_append_u32(m, IFLA_MASTER, bridge_ifi);
 350         if (r < 0)
 351                 return r;
 352
 353         r = sd_netlink_call(rtnl, m, 0, NULL);
 354         if (r < 0)
 355                 return r;
 356
 357         return bridge_ifi;
 358 }
 359
 360 static int create_bridge(sd_netlink *rtnl, const char *bridge_name) {
 361         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 362         int r;
 363
 364         r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 365         if (r < 0)
 366                 return r;
 367
 368         r = sd_netlink_message_append_string(m, IFLA_IFNAME, bridge_name);
 369         if (r < 0)
 370                 return r;
 371
 372         r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 373         if (r < 0)
 374                 return r;
 375
 376         r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "bridge");
 377         if (r < 0)
 378                 return r;
 379
 380         r = sd_netlink_message_close_container(m);
 381         if (r < 0)
 382                 return r;
 383
 384         r = sd_netlink_message_close_container(m);
 385         if (r < 0)
 386                 return r;
 387
 388         r = sd_netlink_call(rtnl, m, 0, NULL);
 389         if (r < 0)
 390                 return r;
 391
 392         return 0;
 393 }
 394
 395 int setup_bridge(const char *veth_name, const char *bridge_name, bool create) {
 396         _cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
 397         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 398         int r, bridge_ifi;
 399         unsigned n = 0;
 400
 401         assert(veth_name);
 402         assert(bridge_name);
 403
 404         r = sd_netlink_open(&rtnl);
 405         if (r < 0)
 406                 return log_error_errno(r, "Failed to connect to netlink: %m");
 407
 408         if (create) {
 409                 /* We take a system-wide lock here, so that we can safely check whether there's still a member in the
 410                  * bridge before removing it, without risking interference from other nspawn instances. */
 411
 412                 r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
 413                 if (r < 0)
 414                         return log_error_errno(r, "Failed to take network zone lock: %m");
 415         }
 416
 417         for (;;) {
 418                 bridge_ifi = join_bridge(rtnl, veth_name, bridge_name);
 419                 if (bridge_ifi >= 0)
 420                         return bridge_ifi;
 421                 if (bridge_ifi != -ENODEV || !create || n > 10)
 422                         return log_error_errno(bridge_ifi, "Failed to add interface %s to bridge %s: %m", veth_name, bridge_name);
 423
 424                 /* Count attempts, so that we don't enter an endless loop here. */
 425                 n++;
 426
 427                 /* The bridge doesn't exist yet. Let's create it */
 428                 r = create_bridge(rtnl, bridge_name);
 429                 if (r < 0)
 430                         return log_error_errno(r, "Failed to create bridge interface %s: %m", bridge_name);
 431
 432                 /* Try again, now that the bridge exists */
 433         }
 434 }
 435
 436 int remove_bridge(const char *bridge_name) {
 437         _cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
 438         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 439         const char *path;
 440         int r;
 441
 442         /* Removes the specified bridge, but only if it is currently empty */
 443
 444         if (isempty(bridge_name))
 445                 return 0;
 446
 447         r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
 448         if (r < 0)
 449                 return log_error_errno(r, "Failed to take network zone lock: %m");
 450
 451         path = strjoina("/sys/class/net/", bridge_name, "/brif");
 452
 453         r = dir_is_empty(path);
 454         if (r == -ENOENT) /* Already gone? */
 455                 return 0;
 456         if (r < 0)
 457                 return log_error_errno(r, "Can't detect if bridge %s is empty: %m", bridge_name);
 458         if (r == 0) /* Still populated, leave it around */
 459                 return 0;
 460
 461         r = sd_netlink_open(&rtnl);
 462         if (r < 0)
 463                 return log_error_errno(r, "Failed to connect to netlink: %m");
 464
 465         return remove_one_link(rtnl, bridge_name);
 466 }
 467
 468 int test_network_interface_initialized(const char *name) {
 469         _cleanup_(sd_device_unrefp) sd_device *d = NULL;
 470         int ifi, r;
 471         char ifi_str[2 + DECIMAL_STR_MAX(int)];
 472
 473         if (path_is_read_only_fs("/sys"))
 474                 return 0;
 475
 476         /* udev should be around. */
 477
 478         ifi = resolve_interface_or_warn(NULL, name);
 479         if (ifi < 0)
 480                 return ifi;
 481
 482         sprintf(ifi_str, "n%i", ifi);
 483         r = sd_device_new_from_device_id(&d, ifi_str);
 484         if (r < 0)
 485                 return log_error_errno(r, "Failed to get device %s: %m", name);
 486
 487         r = sd_device_get_is_initialized(d);
 488         if (r < 0)
 489                 return log_error_errno(r, "Failed to determine whether interface %s is initialized: %m", name);
 490         if (r == 0)
 491                 return log_error_errno(SYNTHETIC_ERRNO(EBUSY), "Network interface %s is not initialized yet.", name);
 492
 493         r = device_is_renaming(d);
 494         if (r < 0)
 495                 return log_error_errno(r, "Failed to determine the interface %s is being renamed: %m", name);
 496         if (r > 0)
 497                 return log_error_errno(SYNTHETIC_ERRNO(EBUSY), "Interface %s is being renamed.", name);
 498
 499         return 0;
 500 }
 501
 502 int move_network_interfaces(int netns_fd, char **ifaces) {
 503         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 504         char **i;
 505         int r;
 506
 507         if (strv_isempty(ifaces))
 508                 return 0;
 509
 510         r = sd_netlink_open(&rtnl);
 511         if (r < 0)
 512                 return log_error_errno(r, "Failed to connect to netlink: %m");
 513
 514         STRV_FOREACH(i, ifaces) {
 515                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 516                 int ifi;
 517
 518                 ifi = resolve_interface_or_warn(&rtnl, *i);
 519                 if (ifi < 0)
 520                         return ifi;
 521
 522                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
 523                 if (r < 0)
 524                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 525
 526                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_FD, netns_fd);
 527                 if (r < 0)
 528                         return log_error_errno(r, "Failed to append namespace fd to netlink message: %m");
 529
 530                 r = sd_netlink_call(rtnl, m, 0, NULL);
 531                 if (r < 0)
 532                         return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
 533         }
 534
 535         return 0;
 536 }
 537
 538 int setup_macvlan(const char *machine_name, pid_t pid, char **ifaces) {
 539         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 540         unsigned idx = 0;
 541         char **i;
 542         int r;
 543
 544         if (strv_isempty(ifaces))
 545                 return 0;
 546
 547         r = sd_netlink_open(&rtnl);
 548         if (r < 0)
 549                 return log_error_errno(r, "Failed to connect to netlink: %m");
 550
 551         STRV_FOREACH(i, ifaces) {
 552                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 553                 _cleanup_free_ char *n = NULL, *a = NULL;
 554                 struct ether_addr mac;
 555                 int ifi;
 556
 557                 ifi = resolve_interface_or_warn(&rtnl, *i);
 558                 if (ifi < 0)
 559                         return ifi;
 560
 561                 r = generate_mac(machine_name, &mac, MACVLAN_HASH_KEY, idx++);
 562                 if (r < 0)
 563                         return log_error_errno(r, "Failed to create MACVLAN MAC address: %m");
 564
 565                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 566                 if (r < 0)
 567                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 568
 569                 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
 570                 if (r < 0)
 571                         return log_error_errno(r, "Failed to add netlink interface index: %m");
 572
 573                 n = strjoin("mv-", *i);
 574                 if (!n)
 575                         return log_oom();
 576
 577                 r = shorten_ifname(n);
 578                 if (r > 0) {
 579                         a = strjoin("mv-", *i);
 580                         if (!a)
 581                                 return log_oom();
 582                 }
 583
 584                 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
 585                 if (r < 0)
 586                         return log_error_errno(r, "Failed to add netlink interface name: %m");
 587
 588                 r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
 589                 if (r < 0)
 590                         return log_error_errno(r, "Failed to add netlink MAC address: %m");
 591
 592                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 593                 if (r < 0)
 594                         return log_error_errno(r, "Failed to add netlink namespace field: %m");
 595
 596                 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 597                 if (r < 0)
 598                         return log_error_errno(r, "Failed to open netlink container: %m");
 599
 600                 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
 601                 if (r < 0)
 602                         return log_error_errno(r, "Failed to open netlink container: %m");
 603
 604                 r = sd_netlink_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
 605                 if (r < 0)
 606                         return log_error_errno(r, "Failed to append macvlan mode: %m");
 607
 608                 r = sd_netlink_message_close_container(m);
 609                 if (r < 0)
 610                         return log_error_errno(r, "Failed to close netlink container: %m");
 611
 612                 r = sd_netlink_message_close_container(m);
 613                 if (r < 0)
 614                         return log_error_errno(r, "Failed to close netlink container: %m");
 615
 616                 r = sd_netlink_call(rtnl, m, 0, NULL);
 617                 if (r < 0)
 618                         return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
 619
 620                 (void) set_alternative_ifname(rtnl, n, a);
 621         }
 622
 623         return 0;
 624 }
 625
 626 int setup_ipvlan(const char *machine_name, pid_t pid, char **ifaces) {
 627         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 628         char **i;
 629         int r;
 630
 631         if (strv_isempty(ifaces))
 632                 return 0;
 633
 634         r = sd_netlink_open(&rtnl);
 635         if (r < 0)
 636                 return log_error_errno(r, "Failed to connect to netlink: %m");
 637
 638         STRV_FOREACH(i, ifaces) {
 639                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 640                 _cleanup_free_ char *n = NULL, *a = NULL;
 641                 int ifi;
 642
 643                 ifi = resolve_interface_or_warn(&rtnl, *i);
 644                 if (ifi < 0)
 645                         return ifi;
 646
 647                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 648                 if (r < 0)
 649                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 650
 651                 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
 652                 if (r < 0)
 653                         return log_error_errno(r, "Failed to add netlink interface index: %m");
 654
 655                 n = strjoin("iv-", *i);
 656                 if (!n)
 657                         return log_oom();
 658
 659                 r = shorten_ifname(n);
 660                 if (r > 0) {
 661                         a = strjoin("iv-", *i);
 662                         if (!a)
 663                                 return log_oom();
 664                 }
 665
 666                 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
 667                 if (r < 0)
 668                         return log_error_errno(r, "Failed to add netlink interface name: %m");
 669
 670                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 671                 if (r < 0)
 672                         return log_error_errno(r, "Failed to add netlink namespace field: %m");
 673
 674                 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 675                 if (r < 0)
 676                         return log_error_errno(r, "Failed to open netlink container: %m");
 677
 678                 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "ipvlan");
 679                 if (r < 0)
 680                         return log_error_errno(r, "Failed to open netlink container: %m");
 681
 682                 r = sd_netlink_message_append_u16(m, IFLA_IPVLAN_MODE, IPVLAN_MODE_L2);
 683                 if (r < 0)
 684                         return log_error_errno(r, "Failed to add ipvlan mode: %m");
 685
 686                 r = sd_netlink_message_close_container(m);
 687                 if (r < 0)
 688                         return log_error_errno(r, "Failed to close netlink container: %m");
 689
 690                 r = sd_netlink_message_close_container(m);
 691                 if (r < 0)
 692                         return log_error_errno(r, "Failed to close netlink container: %m");
 693
 694                 r = sd_netlink_call(rtnl, m, 0, NULL);
 695                 if (r < 0)
 696                         return log_error_errno(r, "Failed to add new ipvlan interfaces: %m");
 697
 698                 (void) set_alternative_ifname(rtnl, n, a);
 699         }
 700
 701         return 0;
 702 }
 703
 704 int veth_extra_parse(char ***l, const char *p) {
 705         _cleanup_free_ char *a = NULL, *b = NULL;
 706         int r;
 707
 708         r = extract_first_word(&p, &a, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 709         if (r < 0)
 710                 return r;
 711         if (r == 0 || !ifname_valid(a))
 712                 return -EINVAL;
 713
 714         r = extract_first_word(&p, &b, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 715         if (r < 0)
 716                 return r;
 717         if (r == 0 || !ifname_valid(b)) {
 718                 free(b);
 719                 b = strdup(a);
 720                 if (!b)
 721                         return -ENOMEM;
 722         }
 723
 724         if (p)
 725                 return -EINVAL;
 726
 727         r = strv_push_pair(l, a, b);
 728         if (r < 0)
 729                 return -ENOMEM;
 730
 731         a = b = NULL;
 732         return 0;
 733 }
 734
 735 int remove_veth_links(const char *primary, char **pairs) {
 736         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 737         char **a, **b;
 738         int r;
 739
 740         /* In some cases the kernel might pin the veth links between host and container even after the namespace
 741          * died. Hence, let's better remove them explicitly too. */
 742
 743         if (isempty(primary) && strv_isempty(pairs))
 744                 return 0;
 745
 746         r = sd_netlink_open(&rtnl);
 747         if (r < 0)
 748                 return log_error_errno(r, "Failed to connect to netlink: %m");
 749
 750         remove_one_link(rtnl, primary);
 751
 752         STRV_FOREACH_PAIR(a, b, pairs)
 753                 remove_one_link(rtnl, *a);
 754
 755         return 0;
 756 }