[thirdparty/systemd.git] / src / nspawn / nspawn-network.c

/* SPDX-License-Identifier: LGPL-2.1+ */

#include <linux/veth.h>
#include <net/if.h>
#include <sys/file.h>

#include "sd-device.h"
#include "sd-id128.h"
#include "sd-netlink.h"

#include "alloc-util.h"
#include "ether-addr-util.h"
#include "lockfile-util.h"
#include "netlink-util.h"
#include "nspawn-network.h"
#include "siphash24.h"
#include "socket-util.h"
#include "stat-util.h"
#include "string-util.h"
#include "strv.h"
#include "util.h"

#define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
#define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
#define VETH_EXTRA_HOST_HASH_KEY SD_ID128_MAKE(48,c7,f6,b7,ea,9d,4c,9e,b7,28,d4,de,91,d5,bf,66)
#define VETH_EXTRA_CONTAINER_HASH_KEY SD_ID128_MAKE(af,50,17,61,ce,f9,4d,35,84,0d,2b,20,54,be,ce,59)
#define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)

static int remove_one_link(sd_netlink *rtnl, const char *name) {
        _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
        int r;

        if (isempty(name))
                return 0;

        r = sd_rtnl_message_new_link(rtnl, &m, RTM_DELLINK, 0);
        if (r < 0)
                return log_error_errno(r, "Failed to allocate netlink message: %m");

        r = sd_netlink_message_append_string(m, IFLA_IFNAME, name);
        if (r < 0)
                return log_error_errno(r, "Failed to add netlink interface name: %m");

        r = sd_netlink_call(rtnl, m, 0, NULL);
        if (r == -ENODEV) /* Already gone */
                return 0;
        if (r < 0)
                return log_error_errno(r, "Failed to remove interface %s: %m", name);

        return 1;
}

static int generate_mac(
                const char *machine_name,
                struct ether_addr *mac,
                sd_id128_t hash_key,
                uint64_t idx) {

        uint64_t result;
        size_t l, sz;
        uint8_t *v, *i;
        int r;

        l = strlen(machine_name);
        sz = sizeof(sd_id128_t) + l;
        if (idx > 0)
                sz += sizeof(idx);

        v = alloca(sz);

        /* fetch some persistent data unique to the host */
        r = sd_id128_get_machine((sd_id128_t*) v);
        if (r < 0)
                return r;

        /* combine with some data unique (on this host) to this
         * container instance */
        i = mempcpy(v + sizeof(sd_id128_t), machine_name, l);
        if (idx > 0) {
                idx = htole64(idx);
                memcpy(i, &idx, sizeof(idx));
        }

        /* Let's hash the host machine ID plus the container name. We
         * use a fixed, but originally randomly created hash key here. */
        result = htole64(siphash24(v, sz, hash_key.bytes));

        assert_cc(ETH_ALEN <= sizeof(result));
        memcpy(mac->ether_addr_octet, &result, ETH_ALEN);

        /* see eth_random_addr in the kernel */
        mac->ether_addr_octet[0] &= 0xfe;        /* clear multicast bit */
        mac->ether_addr_octet[0] |= 0x02;        /* set local assignment bit (IEEE802) */

        return 0;
}

static int add_veth(
                sd_netlink *rtnl,
                pid_t pid,
                const char *ifname_host,
                const struct ether_addr *mac_host,
                const char *ifname_container,
                const struct ether_addr *mac_container) {

        _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
        int r;

        assert(rtnl);
        assert(ifname_host);
        assert(mac_host);
        assert(ifname_container);
        assert(mac_container);

        r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
        if (r < 0)
                return log_error_errno(r, "Failed to allocate netlink message: %m");

        r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_host);
        if (r < 0)
                return log_error_errno(r, "Failed to add netlink interface name: %m");

        r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_host);
        if (r < 0)
                return log_error_errno(r, "Failed to add netlink MAC address: %m");

        r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
        if (r < 0)
                return log_error_errno(r, "Failed to open netlink container: %m");

        r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "veth");
        if (r < 0)
                return log_error_errno(r, "Failed to open netlink container: %m");

        r = sd_netlink_message_open_container(m, VETH_INFO_PEER);
        if (r < 0)
                return log_error_errno(r, "Failed to open netlink container: %m");

        r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_container);
        if (r < 0)
                return log_error_errno(r, "Failed to add netlink interface name: %m");

        r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_container);
        if (r < 0)
                return log_error_errno(r, "Failed to add netlink MAC address: %m");

        r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
        if (r < 0)
                return log_error_errno(r, "Failed to add netlink namespace field: %m");

        r = sd_netlink_message_close_container(m);
        if (r < 0)
                return log_error_errno(r, "Failed to close netlink container: %m");

        r = sd_netlink_message_close_container(m);
        if (r < 0)
                return log_error_errno(r, "Failed to close netlink container: %m");

        r = sd_netlink_message_close_container(m);
        if (r < 0)
                return log_error_errno(r, "Failed to close netlink container: %m");

        r = sd_netlink_call(rtnl, m, 0, NULL);
        if (r < 0)
                return log_error_errno(r, "Failed to add new veth interfaces (%s:%s): %m", ifname_host, ifname_container);

        return 0;
}

int setup_veth(const char *machine_name,
               pid_t pid,
               char iface_name[IFNAMSIZ],
               bool bridge) {

        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        struct ether_addr mac_host, mac_container;
        int r, i;

        assert(machine_name);
        assert(pid > 0);
        assert(iface_name);

        /* Use two different interface name prefixes depending whether
         * we are in bridge mode or not. */
        snprintf(iface_name, IFNAMSIZ - 1, "%s-%s",
                 bridge ? "vb" : "ve", machine_name);

        r = generate_mac(machine_name, &mac_container, CONTAINER_HASH_KEY, 0);
        if (r < 0)
                return log_error_errno(r, "Failed to generate predictable MAC address for container side: %m");

        r = generate_mac(machine_name, &mac_host, HOST_HASH_KEY, 0);
        if (r < 0)
                return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");

        r = sd_netlink_open(&rtnl);
        if (r < 0)
                return log_error_errno(r, "Failed to connect to netlink: %m");

        r = add_veth(rtnl, pid, iface_name, &mac_host, "host0", &mac_container);
        if (r < 0)
                return r;

        i = (int) if_nametoindex(iface_name);
        if (i <= 0)
                return log_error_errno(errno, "Failed to resolve interface %s: %m", iface_name);

        return i;
}

int setup_veth_extra(
                const char *machine_name,
                pid_t pid,
                char **pairs) {

        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        uint64_t idx = 0;
        char **a, **b;
        int r;

        assert(machine_name);
        assert(pid > 0);

        if (strv_isempty(pairs))
                return 0;

        r = sd_netlink_open(&rtnl);
        if (r < 0)
                return log_error_errno(r, "Failed to connect to netlink: %m");

        STRV_FOREACH_PAIR(a, b, pairs) {
                struct ether_addr mac_host, mac_container;

                r = generate_mac(machine_name, &mac_container, VETH_EXTRA_CONTAINER_HASH_KEY, idx);
                if (r < 0)
                        return log_error_errno(r, "Failed to generate predictable MAC address for container side of extra veth link: %m");

                r = generate_mac(machine_name, &mac_host, VETH_EXTRA_HOST_HASH_KEY, idx);
                if (r < 0)
                        return log_error_errno(r, "Failed to generate predictable MAC address for container side of extra veth link: %m");

                r = add_veth(rtnl, pid, *a, &mac_host, *b, &mac_container);
                if (r < 0)
                        return r;

                idx++;
        }

        return 0;
}

static int join_bridge(sd_netlink *rtnl, const char *veth_name, const char *bridge_name) {
        _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
        int r, bridge_ifi;

        assert(rtnl);
        assert(veth_name);
        assert(bridge_name);

        bridge_ifi = (int) if_nametoindex(bridge_name);
        if (bridge_ifi <= 0)
                return -errno;

        r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
        if (r < 0)
                return r;

        r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
        if (r < 0)
                return r;

        r = sd_netlink_message_append_string(m, IFLA_IFNAME, veth_name);
        if (r < 0)
                return r;

        r = sd_netlink_message_append_u32(m, IFLA_MASTER, bridge_ifi);
        if (r < 0)
                return r;

        r = sd_netlink_call(rtnl, m, 0, NULL);
        if (r < 0)
                return r;

        return bridge_ifi;
}

static int create_bridge(sd_netlink *rtnl, const char *bridge_name) {
        _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
        int r;

        r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
        if (r < 0)
                return r;

        r = sd_netlink_message_append_string(m, IFLA_IFNAME, bridge_name);
        if (r < 0)
                return r;

        r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
        if (r < 0)
                return r;

        r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "bridge");
        if (r < 0)
                return r;

        r = sd_netlink_message_close_container(m);
        if (r < 0)
                return r;

        r = sd_netlink_message_close_container(m);
        if (r < 0)
                return r;

        r = sd_netlink_call(rtnl, m, 0, NULL);
        if (r < 0)
                return r;

        return 0;
}

int setup_bridge(const char *veth_name, const char *bridge_name, bool create) {
        _cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        int r, bridge_ifi;
        unsigned n = 0;

        assert(veth_name);
        assert(bridge_name);

        r = sd_netlink_open(&rtnl);
        if (r < 0)
                return log_error_errno(r, "Failed to connect to netlink: %m");

        if (create) {
                /* We take a system-wide lock here, so that we can safely check whether there's still a member in the
                 * bridge before removing it, without risking interference from other nspawn instances. */

                r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
                if (r < 0)
                        return log_error_errno(r, "Failed to take network zone lock: %m");
        }

        for (;;) {
                bridge_ifi = join_bridge(rtnl, veth_name, bridge_name);
                if (bridge_ifi >= 0)
                        return bridge_ifi;
                if (bridge_ifi != -ENODEV || !create || n > 10)
                        return log_error_errno(bridge_ifi, "Failed to add interface %s to bridge %s: %m", veth_name, bridge_name);

                /* Count attempts, so that we don't enter an endless loop here. */
                n++;

                /* The bridge doesn't exist yet. Let's create it */
                r = create_bridge(rtnl, bridge_name);
                if (r < 0)
                        return log_error_errno(r, "Failed to create bridge interface %s: %m", bridge_name);

                /* Try again, now that the bridge exists */
        }
}

int remove_bridge(const char *bridge_name) {
        _cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        const char *path;
        int r;

        /* Removes the specified bridge, but only if it is currently empty */

        if (isempty(bridge_name))
                return 0;

        r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
        if (r < 0)
                return log_error_errno(r, "Failed to take network zone lock: %m");

        path = strjoina("/sys/class/net/", bridge_name, "/brif");

        r = dir_is_empty(path);
        if (r == -ENOENT) /* Already gone? */
                return 0;
        if (r < 0)
                return log_error_errno(r, "Can't detect if bridge %s is empty: %m", bridge_name);
        if (r == 0) /* Still populated, leave it around */
                return 0;

        r = sd_netlink_open(&rtnl);
        if (r < 0)
                return log_error_errno(r, "Failed to connect to netlink: %m");

        return remove_one_link(rtnl, bridge_name);
}

static int parse_interface(const char *name) {
        _cleanup_(sd_device_unrefp) sd_device *d = NULL;
        char ifi_str[2 + DECIMAL_STR_MAX(int)];
        int ifi, initialized, r;

        ifi = (int) if_nametoindex(name);
        if (ifi <= 0)
                return log_error_errno(errno, "Failed to resolve interface %s: %m", name);

        sprintf(ifi_str, "n%i", ifi);
        r = sd_device_new_from_device_id(&d, ifi_str);
        if (r < 0)
                return log_error_errno(r, "Failed to get device for interface %s: %m", name);

        r = sd_device_get_is_initialized(d, &initialized);
        if (r < 0)
                return log_error_errno(r, "Failed to determine whether interface %s is initialized or not: %m", name);

        if (!initialized) {
                log_error("Network interface %s is not initialized yet.", name);
                return -EBUSY;
        }

        return ifi;
}

int move_network_interfaces(pid_t pid, char **ifaces) {
        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        char **i;
        int r;

        if (strv_isempty(ifaces))
                return 0;

        r = sd_netlink_open(&rtnl);
        if (r < 0)
                return log_error_errno(r, "Failed to connect to netlink: %m");

        STRV_FOREACH(i, ifaces) {
                _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
                int ifi;

                ifi = parse_interface(*i);
                if (ifi < 0)
                        return ifi;

                r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
                if (r < 0)
                        return log_error_errno(r, "Failed to allocate netlink message: %m");

                r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
                if (r < 0)
                        return log_error_errno(r, "Failed to append namespace PID to netlink message: %m");

                r = sd_netlink_call(rtnl, m, 0, NULL);
                if (r < 0)
                        return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
        }

        return 0;
}

int setup_macvlan(const char *machine_name, pid_t pid, char **ifaces) {
        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        unsigned idx = 0;
        char **i;
        int r;

        if (strv_isempty(ifaces))
                return 0;

        r = sd_netlink_open(&rtnl);
        if (r < 0)
                return log_error_errno(r, "Failed to connect to netlink: %m");

        STRV_FOREACH(i, ifaces) {
                _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
                _cleanup_free_ char *n = NULL;
                struct ether_addr mac;
                int ifi;

                ifi = parse_interface(*i);
                if (ifi < 0)
                        return ifi;

                r = generate_mac(machine_name, &mac, MACVLAN_HASH_KEY, idx++);
                if (r < 0)
                        return log_error_errno(r, "Failed to create MACVLAN MAC address: %m");

                r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
                if (r < 0)
                        return log_error_errno(r, "Failed to allocate netlink message: %m");

                r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
                if (r < 0)
                        return log_error_errno(r, "Failed to add netlink interface index: %m");

                n = strappend("mv-", *i);
                if (!n)
                        return log_oom();

                strshorten(n, IFNAMSIZ-1);

                r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
                if (r < 0)
                        return log_error_errno(r, "Failed to add netlink interface name: %m");

                r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
                if (r < 0)
                        return log_error_errno(r, "Failed to add netlink MAC address: %m");

                r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
                if (r < 0)
                        return log_error_errno(r, "Failed to add netlink namespace field: %m");

                r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
                if (r < 0)
                        return log_error_errno(r, "Failed to open netlink container: %m");

                r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
                if (r < 0)
                        return log_error_errno(r, "Failed to open netlink container: %m");

                r = sd_netlink_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
                if (r < 0)
                        return log_error_errno(r, "Failed to append macvlan mode: %m");

                r = sd_netlink_message_close_container(m);
                if (r < 0)
                        return log_error_errno(r, "Failed to close netlink container: %m");

                r = sd_netlink_message_close_container(m);
                if (r < 0)
                        return log_error_errno(r, "Failed to close netlink container: %m");

                r = sd_netlink_call(rtnl, m, 0, NULL);
                if (r < 0)
                        return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
        }

        return 0;
}

int setup_ipvlan(const char *machine_name, pid_t pid, char **ifaces) {
        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        char **i;
        int r;

        if (strv_isempty(ifaces))
                return 0;

        r = sd_netlink_open(&rtnl);
        if (r < 0)
                return log_error_errno(r, "Failed to connect to netlink: %m");

        STRV_FOREACH(i, ifaces) {
                _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
                _cleanup_free_ char *n = NULL;
                int ifi;

                ifi = parse_interface(*i);
                if (ifi < 0)
                        return ifi;

                r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
                if (r < 0)
                        return log_error_errno(r, "Failed to allocate netlink message: %m");

                r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
                if (r < 0)
                        return log_error_errno(r, "Failed to add netlink interface index: %m");

                n = strappend("iv-", *i);
                if (!n)
                        return log_oom();

                strshorten(n, IFNAMSIZ-1);

                r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
                if (r < 0)
                        return log_error_errno(r, "Failed to add netlink interface name: %m");

                r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
                if (r < 0)
                        return log_error_errno(r, "Failed to add netlink namespace field: %m");

                r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
                if (r < 0)
                        return log_error_errno(r, "Failed to open netlink container: %m");

                r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "ipvlan");
                if (r < 0)
                        return log_error_errno(r, "Failed to open netlink container: %m");

                r = sd_netlink_message_append_u16(m, IFLA_IPVLAN_MODE, IPVLAN_MODE_L2);
                if (r < 0)
                        return log_error_errno(r, "Failed to add ipvlan mode: %m");

                r = sd_netlink_message_close_container(m);
                if (r < 0)
                        return log_error_errno(r, "Failed to close netlink container: %m");

                r = sd_netlink_message_close_container(m);
                if (r < 0)
                        return log_error_errno(r, "Failed to close netlink container: %m");

                r = sd_netlink_call(rtnl, m, 0, NULL);
                if (r < 0)
                        return log_error_errno(r, "Failed to add new ipvlan interfaces: %m");
        }

        return 0;
}

int veth_extra_parse(char ***l, const char *p) {
        _cleanup_free_ char *a = NULL, *b = NULL;
        int r;

        r = extract_first_word(&p, &a, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
        if (r < 0)
                return r;
        if (r == 0 || !ifname_valid(a))
                return -EINVAL;

        r = extract_first_word(&p, &b, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
        if (r < 0)
                return r;
        if (r == 0 || !ifname_valid(b)) {
                free(b);
                b = strdup(a);
                if (!b)
                        return -ENOMEM;
        }

        if (p)
                return -EINVAL;

        r = strv_push_pair(l, a, b);
        if (r < 0)
                return -ENOMEM;

        a = b = NULL;
        return 0;
}

int remove_veth_links(const char *primary, char **pairs) {
        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        char **a, **b;
        int r;

        /* In some cases the kernel might pin the veth links between host and container even after the namespace
         * died. Hence, let's better remove them explicitly too. */

        if (isempty(primary) && strv_isempty(pairs))
                return 0;

        r = sd_netlink_open(&rtnl);
        if (r < 0)
                return log_error_errno(r, "Failed to connect to netlink: %m");

        remove_one_link(rtnl, primary);

        STRV_FOREACH_PAIR(a, b, pairs)
                remove_one_link(rtnl, *a);

        return 0;
}
Commit	Line	Data
53e1b683	1	/* SPDX-License-Identifier: LGPL-2.1+ */
9a2a5625 LP	2
	3	#include <linux/veth.h>
	4	#include <net/if.h>
fe993888	5	#include <sys/file.h>
9a2a5625	6
f55b0d3f	7	#include "sd-device.h"
9a2a5625 LP	8	#include "sd-id128.h"
9a2a5625 LP	9	#include "sd-netlink.h"
9a2a5625	10
b5efdb8a	11	#include "alloc-util.h"
9a2a5625	12	#include "ether-addr-util.h"
22b28dfd	13	#include "lockfile-util.h"
9a2a5625	14	#include "netlink-util.h"
cf0fbc49	15	#include "nspawn-network.h"
07630cea	16	#include "siphash24.h"
ef76dff2 LP	17	#include "socket-util.h"
ef76dff2 LP	18	#include "stat-util.h"
07630cea	19	#include "string-util.h"
f55b0d3f	20	#include "strv.h"
07630cea	21	#include "util.h"
9a2a5625 LP	22
	23	#define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
	24	#define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
f6d6bad1 LP	25	#define VETH_EXTRA_HOST_HASH_KEY SD_ID128_MAKE(48,c7,f6,b7,ea,9d,4c,9e,b7,28,d4,de,91,d5,bf,66)
f6d6bad1 LP	26	#define VETH_EXTRA_CONTAINER_HASH_KEY SD_ID128_MAKE(af,50,17,61,ce,f9,4d,35,84,0d,2b,20,54,be,ce,59)
9a2a5625 LP	27	#define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)
9a2a5625 LP	28
22b28dfd LP	29	static int remove_one_link(sd_netlink rtnl, const char name) {
	30	_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
	31	int r;
	32
	33	if (isempty(name))
	34	return 0;
	35
	36	r = sd_rtnl_message_new_link(rtnl, &m, RTM_DELLINK, 0);
	37	if (r < 0)
	38	return log_error_errno(r, "Failed to allocate netlink message: %m");
	39
	40	r = sd_netlink_message_append_string(m, IFLA_IFNAME, name);
	41	if (r < 0)
	42	return log_error_errno(r, "Failed to add netlink interface name: %m");
	43
	44	r = sd_netlink_call(rtnl, m, 0, NULL);
	45	if (r == -ENODEV) /* Already gone */
	46	return 0;
	47	if (r < 0)
	48	return log_error_errno(r, "Failed to remove interface %s: %m", name);
	49
	50	return 1;
	51	}
	52
9a2a5625 LP	53	static int generate_mac(
	54	const char *machine_name,
	55	struct ether_addr *mac,
	56	sd_id128_t hash_key,
	57	uint64_t idx) {
	58
dbe81cbd	59	uint64_t result;
9a2a5625 LP	60	size_t l, sz;
	61	uint8_t v, i;
	62	int r;
	63
	64	l = strlen(machine_name);
	65	sz = sizeof(sd_id128_t) + l;
	66	if (idx > 0)
	67	sz += sizeof(idx);
	68
	69	v = alloca(sz);
	70
	71	/* fetch some persistent data unique to the host */
	72	r = sd_id128_get_machine((sd_id128_t*) v);
	73	if (r < 0)
	74	return r;
	75
	76	/* combine with some data unique (on this host) to this
	77	* container instance */
	78	i = mempcpy(v + sizeof(sd_id128_t), machine_name, l);
	79	if (idx > 0) {
	80	idx = htole64(idx);
	81	memcpy(i, &idx, sizeof(idx));
	82	}
	83
	84	/* Let's hash the host machine ID plus the container name. We
	85	* use a fixed, but originally randomly created hash key here. */
933f9cae	86	result = htole64(siphash24(v, sz, hash_key.bytes));
9a2a5625 LP	87
9a2a5625 LP	88	assert_cc(ETH_ALEN <= sizeof(result));
dbe81cbd	89	memcpy(mac->ether_addr_octet, &result, ETH_ALEN);
9a2a5625 LP	90
	91	/* see eth_random_addr in the kernel */
	92	mac->ether_addr_octet[0] &= 0xfe; /* clear multicast bit */
	93	mac->ether_addr_octet[0] \|= 0x02; /* set local assignment bit (IEEE802) */
	94
	95	return 0;
	96	}
	97
f6d6bad1 LP	98	static int add_veth(
	99	sd_netlink *rtnl,
	100	pid_t pid,
	101	const char *ifname_host,
	102	const struct ether_addr *mac_host,
	103	const char *ifname_container,
	104	const struct ether_addr *mac_container) {
9a2a5625	105
4afd3348	106	_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
f6d6bad1	107	int r;
9a2a5625	108
f6d6bad1 LP	109	assert(rtnl);
	110	assert(ifname_host);
	111	assert(mac_host);
	112	assert(ifname_container);
	113	assert(mac_container);
9a2a5625 LP	114
	115	r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
	116	if (r < 0)
	117	return log_error_errno(r, "Failed to allocate netlink message: %m");
	118
f6d6bad1	119	r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_host);
9a2a5625 LP	120	if (r < 0)
	121	return log_error_errno(r, "Failed to add netlink interface name: %m");
	122
f6d6bad1	123	r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_host);
9a2a5625 LP	124	if (r < 0)
	125	return log_error_errno(r, "Failed to add netlink MAC address: %m");
	126
	127	r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
	128	if (r < 0)
	129	return log_error_errno(r, "Failed to open netlink container: %m");
	130
	131	r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "veth");
	132	if (r < 0)
	133	return log_error_errno(r, "Failed to open netlink container: %m");
	134
	135	r = sd_netlink_message_open_container(m, VETH_INFO_PEER);
	136	if (r < 0)
	137	return log_error_errno(r, "Failed to open netlink container: %m");
	138
f6d6bad1	139	r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_container);
9a2a5625 LP	140	if (r < 0)
	141	return log_error_errno(r, "Failed to add netlink interface name: %m");
	142
f6d6bad1	143	r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_container);
9a2a5625 LP	144	if (r < 0)
	145	return log_error_errno(r, "Failed to add netlink MAC address: %m");
	146
	147	r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
	148	if (r < 0)
	149	return log_error_errno(r, "Failed to add netlink namespace field: %m");
	150
	151	r = sd_netlink_message_close_container(m);
	152	if (r < 0)
	153	return log_error_errno(r, "Failed to close netlink container: %m");
	154
	155	r = sd_netlink_message_close_container(m);
	156	if (r < 0)
	157	return log_error_errno(r, "Failed to close netlink container: %m");
	158
	159	r = sd_netlink_message_close_container(m);
	160	if (r < 0)
	161	return log_error_errno(r, "Failed to close netlink container: %m");
	162
	163	r = sd_netlink_call(rtnl, m, 0, NULL);
	164	if (r < 0)
f6d6bad1 LP	165	return log_error_errno(r, "Failed to add new veth interfaces (%s:%s): %m", ifname_host, ifname_container);
	166
	167	return 0;
	168	}
	169
	170	int setup_veth(const char *machine_name,
	171	pid_t pid,
	172	char iface_name[IFNAMSIZ],
	173	bool bridge) {
	174
4afd3348	175	_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
f6d6bad1 LP	176	struct ether_addr mac_host, mac_container;
	177	int r, i;
	178
	179	assert(machine_name);
	180	assert(pid > 0);
	181	assert(iface_name);
	182
	183	/* Use two different interface name prefixes depending whether
	184	* we are in bridge mode or not. */
	185	snprintf(iface_name, IFNAMSIZ - 1, "%s-%s",
	186	bridge ? "vb" : "ve", machine_name);
	187
	188	r = generate_mac(machine_name, &mac_container, CONTAINER_HASH_KEY, 0);
	189	if (r < 0)
	190	return log_error_errno(r, "Failed to generate predictable MAC address for container side: %m");
	191
	192	r = generate_mac(machine_name, &mac_host, HOST_HASH_KEY, 0);
	193	if (r < 0)
	194	return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");
	195
	196	r = sd_netlink_open(&rtnl);
	197	if (r < 0)
	198	return log_error_errno(r, "Failed to connect to netlink: %m");
	199
	200	r = add_veth(rtnl, pid, iface_name, &mac_host, "host0", &mac_container);
	201	if (r < 0)
	202	return r;
9a2a5625 LP	203
	204	i = (int) if_nametoindex(iface_name);
	205	if (i <= 0)
	206	return log_error_errno(errno, "Failed to resolve interface %s: %m", iface_name);
	207
	208	return i;
	209	}
	210
f6d6bad1 LP	211	int setup_veth_extra(
	212	const char *machine_name,
	213	pid_t pid,
	214	char **pairs) {
	215
4afd3348	216	_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
f6d6bad1 LP	217	uint64_t idx = 0;
	218	char a, b;
	219	int r;
	220
	221	assert(machine_name);
	222	assert(pid > 0);
	223
	224	if (strv_isempty(pairs))
	225	return 0;
	226
	227	r = sd_netlink_open(&rtnl);
	228	if (r < 0)
	229	return log_error_errno(r, "Failed to connect to netlink: %m");
	230
	231	STRV_FOREACH_PAIR(a, b, pairs) {
	232	struct ether_addr mac_host, mac_container;
	233
	234	r = generate_mac(machine_name, &mac_container, VETH_EXTRA_CONTAINER_HASH_KEY, idx);
	235	if (r < 0)
	236	return log_error_errno(r, "Failed to generate predictable MAC address for container side of extra veth link: %m");
	237
	238	r = generate_mac(machine_name, &mac_host, VETH_EXTRA_HOST_HASH_KEY, idx);
	239	if (r < 0)
	240	return log_error_errno(r, "Failed to generate predictable MAC address for container side of extra veth link: %m");
	241
	242	r = add_veth(rtnl, pid, a, &mac_host, b, &mac_container);
	243	if (r < 0)
	244	return r;
	245
313cefa1	246	idx++;
f6d6bad1 LP	247	}
	248
	249	return 0;
	250	}
	251
22b28dfd	252	static int join_bridge(sd_netlink rtnl, const char veth_name, const char *bridge_name) {
4afd3348	253	_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
9a2a5625 LP	254	int r, bridge_ifi;
9a2a5625 LP	255
22b28dfd	256	assert(rtnl);
9a2a5625 LP	257	assert(veth_name);
	258	assert(bridge_name);
	259
	260	bridge_ifi = (int) if_nametoindex(bridge_name);
	261	if (bridge_ifi <= 0)
22b28dfd	262	return -errno;
9a2a5625 LP	263
	264	r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
	265	if (r < 0)
22b28dfd	266	return r;
9a2a5625 LP	267
	268	r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
	269	if (r < 0)
22b28dfd	270	return r;
9a2a5625 LP	271
	272	r = sd_netlink_message_append_string(m, IFLA_IFNAME, veth_name);
	273	if (r < 0)
22b28dfd	274	return r;
9a2a5625 LP	275
	276	r = sd_netlink_message_append_u32(m, IFLA_MASTER, bridge_ifi);
	277	if (r < 0)
22b28dfd	278	return r;
9a2a5625 LP	279
	280	r = sd_netlink_call(rtnl, m, 0, NULL);
	281	if (r < 0)
22b28dfd	282	return r;
9a2a5625 LP	283
	284	return bridge_ifi;
	285	}
	286
22b28dfd LP	287	static int create_bridge(sd_netlink rtnl, const char bridge_name) {
	288	_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
	289	int r;
	290
	291	r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
	292	if (r < 0)
	293	return r;
	294
	295	r = sd_netlink_message_append_string(m, IFLA_IFNAME, bridge_name);
	296	if (r < 0)
	297	return r;
	298
	299	r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
	300	if (r < 0)
	301	return r;
	302
	303	r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "bridge");
	304	if (r < 0)
	305	return r;
	306
	307	r = sd_netlink_message_close_container(m);
	308	if (r < 0)
	309	return r;
	310
	311	r = sd_netlink_message_close_container(m);
	312	if (r < 0)
	313	return r;
	314
	315	r = sd_netlink_call(rtnl, m, 0, NULL);
	316	if (r < 0)
	317	return r;
	318
	319	return 0;
	320	}
	321
	322	int setup_bridge(const char veth_name, const char bridge_name, bool create) {
8e766630	323	_cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
22b28dfd LP	324	_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
	325	int r, bridge_ifi;
	326	unsigned n = 0;
	327
	328	assert(veth_name);
	329	assert(bridge_name);
	330
	331	r = sd_netlink_open(&rtnl);
	332	if (r < 0)
	333	return log_error_errno(r, "Failed to connect to netlink: %m");
	334
	335	if (create) {
	336	/* We take a system-wide lock here, so that we can safely check whether there's still a member in the
6dd6a9c4	337	* bridge before removing it, without risking interference from other nspawn instances. */
22b28dfd LP	338
	339	r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
	340	if (r < 0)
	341	return log_error_errno(r, "Failed to take network zone lock: %m");
	342	}
	343
	344	for (;;) {
	345	bridge_ifi = join_bridge(rtnl, veth_name, bridge_name);
	346	if (bridge_ifi >= 0)
	347	return bridge_ifi;
	348	if (bridge_ifi != -ENODEV \|\| !create \|\| n > 10)
	349	return log_error_errno(bridge_ifi, "Failed to add interface %s to bridge %s: %m", veth_name, bridge_name);
	350
	351	/* Count attempts, so that we don't enter an endless loop here. */
	352	n++;
	353
	354	/* The bridge doesn't exist yet. Let's create it */
	355	r = create_bridge(rtnl, bridge_name);
	356	if (r < 0)
	357	return log_error_errno(r, "Failed to create bridge interface %s: %m", bridge_name);
	358
	359	/* Try again, now that the bridge exists */
	360	}
	361	}
	362
	363	int remove_bridge(const char *bridge_name) {
8e766630	364	_cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
22b28dfd LP	365	_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
	366	const char *path;
	367	int r;
	368
	369	/* Removes the specified bridge, but only if it is currently empty */
	370
	371	if (isempty(bridge_name))
	372	return 0;
	373
	374	r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
	375	if (r < 0)
	376	return log_error_errno(r, "Failed to take network zone lock: %m");
	377
	378	path = strjoina("/sys/class/net/", bridge_name, "/brif");
	379
	380	r = dir_is_empty(path);
	381	if (r == -ENOENT) /* Already gone? */
	382	return 0;
	383	if (r < 0)
	384	return log_error_errno(r, "Can't detect if bridge %s is empty: %m", bridge_name);
	385	if (r == 0) /* Still populated, leave it around */
	386	return 0;
	387
	388	r = sd_netlink_open(&rtnl);
	389	if (r < 0)
	390	return log_error_errno(r, "Failed to connect to netlink: %m");
	391
	392	return remove_one_link(rtnl, bridge_name);
	393	}
	394
f55b0d3f YW	395	static int parse_interface(const char *name) {
f55b0d3f YW	396	_cleanup_(sd_device_unrefp) sd_device *d = NULL;
9a2a5625	397	char ifi_str[2 + DECIMAL_STR_MAX(int)];
f55b0d3f	398	int ifi, initialized, r;
9a2a5625 LP	399
	400	ifi = (int) if_nametoindex(name);
	401	if (ifi <= 0)
	402	return log_error_errno(errno, "Failed to resolve interface %s: %m", name);
	403
	404	sprintf(ifi_str, "n%i", ifi);
f55b0d3f YW	405	r = sd_device_new_from_device_id(&d, ifi_str);
	406	if (r < 0)
	407	return log_error_errno(r, "Failed to get device for interface %s: %m", name);
	408
	409	r = sd_device_get_is_initialized(d, &initialized);
	410	if (r < 0)
	411	return log_error_errno(r, "Failed to determine whether interface %s is initialized or not: %m", name);
9a2a5625	412
f55b0d3f	413	if (!initialized) {
9a2a5625 LP	414	log_error("Network interface %s is not initialized yet.", name);
	415	return -EBUSY;
	416	}
	417
	418	return ifi;
	419	}
	420
	421	int move_network_interfaces(pid_t pid, char **ifaces) {
4afd3348	422	_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
9a2a5625 LP	423	char **i;
	424	int r;
	425
	426	if (strv_isempty(ifaces))
	427	return 0;
	428
	429	r = sd_netlink_open(&rtnl);
	430	if (r < 0)
	431	return log_error_errno(r, "Failed to connect to netlink: %m");
	432
9a2a5625	433	STRV_FOREACH(i, ifaces) {
4afd3348	434	_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
9a2a5625 LP	435	int ifi;
9a2a5625 LP	436
f55b0d3f	437	ifi = parse_interface(*i);
9a2a5625 LP	438	if (ifi < 0)
	439	return ifi;
	440
	441	r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
	442	if (r < 0)
	443	return log_error_errno(r, "Failed to allocate netlink message: %m");
	444
	445	r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
	446	if (r < 0)
	447	return log_error_errno(r, "Failed to append namespace PID to netlink message: %m");
	448
	449	r = sd_netlink_call(rtnl, m, 0, NULL);
	450	if (r < 0)
	451	return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
	452	}
	453
	454	return 0;
	455	}
	456
	457	int setup_macvlan(const char machine_name, pid_t pid, char *ifaces) {
4afd3348	458	_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
9a2a5625 LP	459	unsigned idx = 0;
	460	char **i;
	461	int r;
	462
	463	if (strv_isempty(ifaces))
	464	return 0;
	465
	466	r = sd_netlink_open(&rtnl);
	467	if (r < 0)
	468	return log_error_errno(r, "Failed to connect to netlink: %m");
	469
9a2a5625	470	STRV_FOREACH(i, ifaces) {
4afd3348	471	_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
9a2a5625 LP	472	_cleanup_free_ char *n = NULL;
	473	struct ether_addr mac;
	474	int ifi;
	475
f55b0d3f	476	ifi = parse_interface(*i);
9a2a5625 LP	477	if (ifi < 0)
	478	return ifi;
	479
	480	r = generate_mac(machine_name, &mac, MACVLAN_HASH_KEY, idx++);
	481	if (r < 0)
	482	return log_error_errno(r, "Failed to create MACVLAN MAC address: %m");
	483
	484	r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
	485	if (r < 0)
	486	return log_error_errno(r, "Failed to allocate netlink message: %m");
	487
	488	r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
	489	if (r < 0)
	490	return log_error_errno(r, "Failed to add netlink interface index: %m");
	491
	492	n = strappend("mv-", *i);
	493	if (!n)
	494	return log_oom();
	495
	496	strshorten(n, IFNAMSIZ-1);
	497
	498	r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
	499	if (r < 0)
	500	return log_error_errno(r, "Failed to add netlink interface name: %m");
	501
	502	r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
	503	if (r < 0)
	504	return log_error_errno(r, "Failed to add netlink MAC address: %m");
	505
	506	r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
	507	if (r < 0)
	508	return log_error_errno(r, "Failed to add netlink namespace field: %m");
	509
	510	r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
	511	if (r < 0)
	512	return log_error_errno(r, "Failed to open netlink container: %m");
	513
	514	r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
	515	if (r < 0)
	516	return log_error_errno(r, "Failed to open netlink container: %m");
	517
	518	r = sd_netlink_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
	519	if (r < 0)
	520	return log_error_errno(r, "Failed to append macvlan mode: %m");
	521
	522	r = sd_netlink_message_close_container(m);
	523	if (r < 0)
	524	return log_error_errno(r, "Failed to close netlink container: %m");
	525
	526	r = sd_netlink_message_close_container(m);
	527	if (r < 0)
	528	return log_error_errno(r, "Failed to close netlink container: %m");
	529
	530	r = sd_netlink_call(rtnl, m, 0, NULL);
	531	if (r < 0)
	532	return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
	533	}
	534
	535	return 0;
	536	}
	537
	538	int setup_ipvlan(const char machine_name, pid_t pid, char *ifaces) {
4afd3348	539	_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
9a2a5625 LP	540	char **i;
	541	int r;
	542
	543	if (strv_isempty(ifaces))
	544	return 0;
	545
	546	r = sd_netlink_open(&rtnl);
	547	if (r < 0)
	548	return log_error_errno(r, "Failed to connect to netlink: %m");
	549
9a2a5625	550	STRV_FOREACH(i, ifaces) {
4afd3348	551	_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
9a2a5625 LP	552	_cleanup_free_ char *n = NULL;
	553	int ifi;
	554
f55b0d3f	555	ifi = parse_interface(*i);
9a2a5625 LP	556	if (ifi < 0)
	557	return ifi;
	558
	559	r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
	560	if (r < 0)
	561	return log_error_errno(r, "Failed to allocate netlink message: %m");
	562
	563	r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
	564	if (r < 0)
	565	return log_error_errno(r, "Failed to add netlink interface index: %m");
	566
	567	n = strappend("iv-", *i);
	568	if (!n)
	569	return log_oom();
	570
	571	strshorten(n, IFNAMSIZ-1);
	572
	573	r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
	574	if (r < 0)
	575	return log_error_errno(r, "Failed to add netlink interface name: %m");
	576
	577	r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
	578	if (r < 0)
	579	return log_error_errno(r, "Failed to add netlink namespace field: %m");
	580
	581	r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
	582	if (r < 0)
	583	return log_error_errno(r, "Failed to open netlink container: %m");
	584
	585	r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "ipvlan");
	586	if (r < 0)
	587	return log_error_errno(r, "Failed to open netlink container: %m");
	588
	589	r = sd_netlink_message_append_u16(m, IFLA_IPVLAN_MODE, IPVLAN_MODE_L2);
	590	if (r < 0)
	591	return log_error_errno(r, "Failed to add ipvlan mode: %m");
	592
	593	r = sd_netlink_message_close_container(m);
	594	if (r < 0)
	595	return log_error_errno(r, "Failed to close netlink container: %m");
	596
	597	r = sd_netlink_message_close_container(m);
	598	if (r < 0)
	599	return log_error_errno(r, "Failed to close netlink container: %m");
	600
	601	r = sd_netlink_call(rtnl, m, 0, NULL);
	602	if (r < 0)
	603	return log_error_errno(r, "Failed to add new ipvlan interfaces: %m");
	604	}
	605
	606	return 0;
	607	}
f6d6bad1 LP	608
	609	int veth_extra_parse(char **l, const char p) {
	610	_cleanup_free_ char a = NULL, b = NULL;
	611	int r;
	612
	613	r = extract_first_word(&p, &a, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
	614	if (r < 0)
	615	return r;
ef76dff2	616	if (r == 0 \|\| !ifname_valid(a))
f6d6bad1 LP	617	return -EINVAL;
	618
	619	r = extract_first_word(&p, &b, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
	620	if (r < 0)
	621	return r;
ef76dff2	622	if (r == 0 \|\| !ifname_valid(b)) {
f6d6bad1 LP	623	free(b);
	624	b = strdup(a);
	625	if (!b)
	626	return -ENOMEM;
	627	}
	628
	629	if (p)
	630	return -EINVAL;
	631
	632	r = strv_push_pair(l, a, b);
	633	if (r < 0)
	634	return -ENOMEM;
	635
	636	a = b = NULL;
	637	return 0;
	638	}
ef3b2aa7	639
ef3b2aa7 LP	640	int remove_veth_links(const char primary, char *pairs) {
	641	_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
	642	char a, b;
	643	int r;
	644
	645	/* In some cases the kernel might pin the veth links between host and container even after the namespace
	646	* died. Hence, let's better remove them explicitly too. */
	647
	648	if (isempty(primary) && strv_isempty(pairs))
	649	return 0;
	650
	651	r = sd_netlink_open(&rtnl);
	652	if (r < 0)
	653	return log_error_errno(r, "Failed to connect to netlink: %m");
	654
22b28dfd	655	remove_one_link(rtnl, primary);
ef3b2aa7 LP	656
ef3b2aa7 LP	657	STRV_FOREACH_PAIR(a, b, pairs)
22b28dfd	658	remove_one_link(rtnl, *a);
ef3b2aa7 LP	659
	660	return 0;
	661	}