src/network/networkd-address.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <net/if.h>
   4 #include <net/if_arp.h>
   5
   6 #include "alloc-util.h"
   7 #include "firewall-util.h"
   8 #include "logarithm.h"
   9 #include "memory-util.h"
  10 #include "netlink-util.h"
  11 #include "networkd-address-pool.h"
  12 #include "networkd-address.h"
  13 #include "networkd-dhcp-prefix-delegation.h"
  14 #include "networkd-dhcp-server.h"
  15 #include "networkd-ipv4acd.h"
  16 #include "networkd-manager.h"
  17 #include "networkd-ndisc.h"
  18 #include "networkd-netlabel.h"
  19 #include "networkd-network.h"
  20 #include "networkd-queue.h"
  21 #include "networkd-route-util.h"
  22 #include "networkd-route.h"
  23 #include "parse-util.h"
  24 #include "string-util.h"
  25 #include "strv.h"
  26 #include "strxcpyx.h"
  27
  28 #define ADDRESSES_PER_LINK_MAX 2048U
  29 #define STATIC_ADDRESSES_PER_NETWORK_MAX 1024U
  30
  31 #define KNOWN_FLAGS                             \
  32         (IFA_F_SECONDARY |                      \
  33          IFA_F_NODAD |                          \
  34          IFA_F_OPTIMISTIC |                     \
  35          IFA_F_DADFAILED |                      \
  36          IFA_F_HOMEADDRESS |                    \
  37          IFA_F_DEPRECATED |                     \
  38          IFA_F_TENTATIVE |                      \
  39          IFA_F_PERMANENT |                      \
  40          IFA_F_MANAGETEMPADDR |                 \
  41          IFA_F_NOPREFIXROUTE |                  \
  42          IFA_F_MCAUTOJOIN |                     \
  43          IFA_F_STABLE_PRIVACY)
  44
  45 /* From net/ipv4/devinet.c */
  46 #define IPV6ONLY_FLAGS                          \
  47         (IFA_F_NODAD |                          \
  48          IFA_F_OPTIMISTIC |                     \
  49          IFA_F_DADFAILED |                      \
  50          IFA_F_HOMEADDRESS |                    \
  51          IFA_F_TENTATIVE |                      \
  52          IFA_F_MANAGETEMPADDR |                 \
  53          IFA_F_STABLE_PRIVACY)
  54
  55 /* We do not control the following flags. */
  56 #define UNMANAGED_FLAGS                         \
  57         (IFA_F_SECONDARY |                      \
  58          IFA_F_DADFAILED |                      \
  59          IFA_F_DEPRECATED |                     \
  60          IFA_F_TENTATIVE |                      \
  61          IFA_F_PERMANENT |                      \
  62          IFA_F_STABLE_PRIVACY)
  63
  64 int address_flags_to_string_alloc(uint32_t flags, int family, char **ret) {
  65         _cleanup_free_ char *str = NULL;
  66         static const char* map[] = {
  67                 [LOG2U(IFA_F_SECONDARY)]      = "secondary", /* This is also called "temporary" for ipv6. */
  68                 [LOG2U(IFA_F_NODAD)]          = "nodad",
  69                 [LOG2U(IFA_F_OPTIMISTIC)]     = "optimistic",
  70                 [LOG2U(IFA_F_DADFAILED)]      = "dadfailed",
  71                 [LOG2U(IFA_F_HOMEADDRESS)]    = "home-address",
  72                 [LOG2U(IFA_F_DEPRECATED)]     = "deprecated",
  73                 [LOG2U(IFA_F_TENTATIVE)]      = "tentative",
  74                 [LOG2U(IFA_F_PERMANENT)]      = "permanent",
  75                 [LOG2U(IFA_F_MANAGETEMPADDR)] = "manage-temporary-address",
  76                 [LOG2U(IFA_F_NOPREFIXROUTE)]  = "no-prefixroute",
  77                 [LOG2U(IFA_F_MCAUTOJOIN)]     = "auto-join",
  78                 [LOG2U(IFA_F_STABLE_PRIVACY)] = "stable-privacy",
  79         };
  80
  81         assert(IN_SET(family, AF_INET, AF_INET6));
  82         assert(ret);
  83
  84         for (size_t i = 0; i < ELEMENTSOF(map); i++)
  85                 if (FLAGS_SET(flags, 1 << i) && map[i])
  86                         if (!strextend_with_separator(
  87                                             &str, ",",
  88                                             family == AF_INET6 && (1 << i) == IFA_F_SECONDARY ? "temporary" : map[i]))
  89                                 return -ENOMEM;
  90
  91         *ret = TAKE_PTR(str);
  92         return 0;
  93 }
  94
  95 static LinkAddressState address_state_from_scope(uint8_t scope) {
  96         if (scope < RT_SCOPE_SITE)
  97                 /* universally accessible addresses found */
  98                 return LINK_ADDRESS_STATE_ROUTABLE;
  99
 100         if (scope < RT_SCOPE_HOST)
 101                 /* only link or site local addresses found */
 102                 return LINK_ADDRESS_STATE_DEGRADED;
 103
 104         /* no useful addresses found */
 105         return LINK_ADDRESS_STATE_OFF;
 106 }
 107
 108 void link_get_address_states(
 109                 Link *link,
 110                 LinkAddressState *ret_ipv4,
 111                 LinkAddressState *ret_ipv6,
 112                 LinkAddressState *ret_all) {
 113
 114         uint8_t ipv4_scope = RT_SCOPE_NOWHERE, ipv6_scope = RT_SCOPE_NOWHERE;
 115         Address *address;
 116
 117         assert(link);
 118
 119         SET_FOREACH(address, link->addresses) {
 120                 if (!address_is_ready(address))
 121                         continue;
 122
 123                 if (address->family == AF_INET)
 124                         ipv4_scope = MIN(ipv4_scope, address->scope);
 125
 126                 if (address->family == AF_INET6)
 127                         ipv6_scope = MIN(ipv6_scope, address->scope);
 128         }
 129
 130         if (ret_ipv4)
 131                 *ret_ipv4 = address_state_from_scope(ipv4_scope);
 132         if (ret_ipv6)
 133                 *ret_ipv6 = address_state_from_scope(ipv6_scope);
 134         if (ret_all)
 135                 *ret_all = address_state_from_scope(MIN(ipv4_scope, ipv6_scope));
 136 }
 137
 138 static void address_hash_func(const Address *a, struct siphash *state);
 139 static int address_compare_func(const Address *a1, const Address *a2);
 140 static void address_detach(Address *address);
 141
 142 DEFINE_PRIVATE_HASH_OPS_WITH_KEY_DESTRUCTOR(
 143         address_hash_ops_detach,
 144         Address,
 145         address_hash_func,
 146         address_compare_func,
 147         address_detach);
 148
 149 DEFINE_HASH_OPS(
 150         address_hash_ops,
 151         Address,
 152         address_hash_func,
 153         address_compare_func);
 154
 155 DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(
 156         address_section_hash_ops,
 157         ConfigSection,
 158         config_section_hash_func,
 159         config_section_compare_func,
 160         Address,
 161         address_detach);
 162
 163 int address_new(Address **ret) {
 164         _cleanup_(address_unrefp) Address *address = NULL;
 165
 166         address = new(Address, 1);
 167         if (!address)
 168                 return -ENOMEM;
 169
 170         *address = (Address) {
 171                 .n_ref = 1,
 172                 .family = AF_UNSPEC,
 173                 .scope = RT_SCOPE_UNIVERSE,
 174                 .lifetime_valid_usec = USEC_INFINITY,
 175                 .lifetime_preferred_usec = USEC_INFINITY,
 176                 .set_broadcast = -1,
 177         };
 178
 179         *ret = TAKE_PTR(address);
 180
 181         return 0;
 182 }
 183
 184 int address_new_static(Network *network, const char *filename, unsigned section_line, Address **ret) {
 185         _cleanup_(config_section_freep) ConfigSection *n = NULL;
 186         _cleanup_(address_unrefp) Address *address = NULL;
 187         int r;
 188
 189         assert(network);
 190         assert(ret);
 191         assert(filename);
 192         assert(section_line > 0);
 193
 194         r = config_section_new(filename, section_line, &n);
 195         if (r < 0)
 196                 return r;
 197
 198         address = ordered_hashmap_get(network->addresses_by_section, n);
 199         if (address) {
 200                 *ret = TAKE_PTR(address);
 201                 return 0;
 202         }
 203
 204         if (ordered_hashmap_size(network->addresses_by_section) >= STATIC_ADDRESSES_PER_NETWORK_MAX)
 205                 return -E2BIG;
 206
 207         r = address_new(&address);
 208         if (r < 0)
 209                 return r;
 210
 211         address->network = network;
 212         address->section = TAKE_PTR(n);
 213         address->source = NETWORK_CONFIG_SOURCE_STATIC;
 214         /* This will be adjusted in address_section_verify(). */
 215         address->duplicate_address_detection = _ADDRESS_FAMILY_INVALID;
 216
 217         r = ordered_hashmap_ensure_put(&network->addresses_by_section, &address_section_hash_ops, address->section, address);
 218         if (r < 0)
 219                 return r;
 220
 221         *ret = TAKE_PTR(address);
 222         return 0;
 223 }
 224
 225 static Address* address_detach_impl(Address *address) {
 226         assert(address);
 227         assert(!address->link || !address->network);
 228
 229         if (address->network) {
 230                 assert(address->section);
 231                 ordered_hashmap_remove(address->network->addresses_by_section, address->section);
 232
 233                 if (address->network->dhcp_server_address == address)
 234                         address->network->dhcp_server_address = NULL;
 235
 236                 address->network = NULL;
 237                 return address;
 238         }
 239
 240         if (address->link) {
 241                 set_remove(address->link->addresses, address);
 242
 243                 address->link = NULL;
 244                 return address;
 245         }
 246
 247         return NULL;
 248 }
 249
 250 static void address_detach(Address *address) {
 251         assert(address);
 252
 253         address_unref(address_detach_impl(address));
 254 }
 255
 256 static Address* address_free(Address *address) {
 257         if (!address)
 258                 return NULL;
 259
 260         address_detach_impl(address);
 261
 262         config_section_free(address->section);
 263         free(address->label);
 264         free(address->netlabel);
 265         ipv6_token_unref(address->token);
 266         nft_set_context_clear(&address->nft_set_context);
 267         return mfree(address);
 268 }
 269
 270 DEFINE_TRIVIAL_REF_UNREF_FUNC(Address, address, address_free);
 271
 272 static bool address_lifetime_is_valid(const Address *a) {
 273         assert(a);
 274
 275         return
 276                 a->lifetime_valid_usec == USEC_INFINITY ||
 277                 a->lifetime_valid_usec > now(CLOCK_BOOTTIME);
 278 }
 279
 280 bool address_is_ready(const Address *a) {
 281         assert(a);
 282         assert(a->link);
 283
 284         if (!ipv4acd_bound(a->link, a))
 285                 return false;
 286
 287         if (FLAGS_SET(a->flags, IFA_F_TENTATIVE))
 288                 return false;
 289
 290         if (FLAGS_SET(a->state, NETWORK_CONFIG_STATE_REMOVING))
 291                 return false;
 292
 293         if (!FLAGS_SET(a->state, NETWORK_CONFIG_STATE_CONFIGURED))
 294                 return false;
 295
 296         return address_lifetime_is_valid(a);
 297 }
 298
 299 bool link_check_addresses_ready(Link *link, NetworkConfigSource source) {
 300         Address *a;
 301         bool has = false;
 302
 303         assert(link);
 304
 305         /* Check if all addresses on the interface are ready. If there is no address, this will return false. */
 306
 307         SET_FOREACH(a, link->addresses) {
 308                 if (source >= 0 && a->source != source)
 309                         continue;
 310                 if (address_is_marked(a))
 311                         continue;
 312                 if (!address_exists(a))
 313                         continue;
 314                 if (!address_is_ready(a))
 315                         return false;
 316                 has = true;
 317         }
 318
 319         return has;
 320 }
 321
 322 void link_mark_addresses(Link *link, NetworkConfigSource source) {
 323         Address *a;
 324
 325         assert(link);
 326
 327         SET_FOREACH(a, link->addresses) {
 328                 if (a->source != source)
 329                         continue;
 330
 331                 address_mark(a);
 332         }
 333 }
 334
 335 static int address_get_broadcast(const Address *a, Link *link, struct in_addr *ret) {
 336         struct in_addr b_addr = {};
 337
 338         assert(a);
 339         assert(link);
 340
 341         /* Returns 0 when broadcast address is null, 1 when non-null broadcast address, -EAGAIN when the main
 342          * address is null. */
 343
 344         /* broadcast is only for IPv4. */
 345         if (a->family != AF_INET)
 346                 goto finalize;
 347
 348         /* broadcast address cannot be used when peer address is specified. */
 349         if (in4_addr_is_set(&a->in_addr_peer.in))
 350                 goto finalize;
 351
 352         /* A /31 or /32 IPv4 address does not have a broadcast address.
 353          * See https://tools.ietf.org/html/rfc3021 */
 354         if (a->prefixlen > 30)
 355                 goto finalize;
 356
 357         /* If explicitly configured, use the address as is. */
 358         if (in4_addr_is_set(&a->broadcast)) {
 359                 b_addr = a->broadcast;
 360                 goto finalize;
 361         }
 362
 363         /* If explicitly disabled, then return null address. */
 364         if (a->set_broadcast == 0)
 365                 goto finalize;
 366
 367         /* For wireguard interfaces, broadcast is disabled by default. */
 368         if (a->set_broadcast < 0 && streq_ptr(link->kind, "wireguard"))
 369                 goto finalize;
 370
 371         /* If the main address is null, e.g. Address=0.0.0.0/24, the broadcast address will be automatically
 372          * determined after an address is acquired. */
 373         if (!in4_addr_is_set(&a->in_addr.in))
 374                 return -EAGAIN;
 375
 376         /* Otherwise, generate a broadcast address from the main address and prefix length. */
 377         b_addr.s_addr = a->in_addr.in.s_addr | htobe32(UINT32_C(0xffffffff) >> a->prefixlen);
 378
 379 finalize:
 380         if (ret)
 381                 *ret = b_addr;
 382
 383         return in4_addr_is_set(&b_addr);
 384 }
 385
 386 static void address_set_broadcast(Address *a, Link *link) {
 387         assert(a);
 388         assert_se(address_get_broadcast(a, link, &a->broadcast) >= 0);
 389 }
 390
 391 static void address_set_cinfo(Manager *m, const Address *a, struct ifa_cacheinfo *cinfo) {
 392         usec_t now_usec;
 393
 394         assert(m);
 395         assert(a);
 396         assert(cinfo);
 397
 398         assert_se(sd_event_now(m->event, CLOCK_BOOTTIME, &now_usec) >= 0);
 399
 400         *cinfo = (struct ifa_cacheinfo) {
 401                 .ifa_valid = usec_to_sec(a->lifetime_valid_usec, now_usec),
 402                 .ifa_prefered = usec_to_sec(a->lifetime_preferred_usec, now_usec),
 403         };
 404 }
 405
 406 static void address_set_lifetime(Manager *m, Address *a, const struct ifa_cacheinfo *cinfo) {
 407         usec_t now_usec;
 408
 409         assert(m);
 410         assert(a);
 411         assert(cinfo);
 412
 413         assert_se(sd_event_now(m->event, CLOCK_BOOTTIME, &now_usec) >= 0);
 414
 415         a->lifetime_valid_usec = sec_to_usec(cinfo->ifa_valid, now_usec);
 416         a->lifetime_preferred_usec = sec_to_usec(cinfo->ifa_prefered, now_usec);
 417 }
 418
 419 static bool address_is_static_null(const Address *address) {
 420         assert(address);
 421
 422         if (!address->network)
 423                 return false;
 424
 425         if (!address->requested_as_null)
 426                 return false;
 427
 428         assert(!in_addr_is_set(address->family, &address->in_addr));
 429         return true;
 430 }
 431
 432 static int address_ipv4_prefix(const Address *a, struct in_addr *ret) {
 433         struct in_addr p;
 434         int r;
 435
 436         assert(a);
 437         assert(a->family == AF_INET);
 438         assert(ret);
 439
 440         p = in4_addr_is_set(&a->in_addr_peer.in) ? a->in_addr_peer.in : a->in_addr.in;
 441         r = in4_addr_mask(&p, a->prefixlen);
 442         if (r < 0)
 443                 return r;
 444
 445         *ret = p;
 446         return 0;
 447 }
 448
 449 static void address_hash_func(const Address *a, struct siphash *state) {
 450         assert(a);
 451
 452         siphash24_compress_typesafe(a->family, state);
 453
 454         switch (a->family) {
 455         case AF_INET: {
 456                 struct in_addr prefix;
 457
 458                 siphash24_compress_typesafe(a->prefixlen, state);
 459
 460                 assert_se(address_ipv4_prefix(a, &prefix) >= 0);
 461                 siphash24_compress_typesafe(prefix, state);
 462
 463                 siphash24_compress_typesafe(a->in_addr.in, state);
 464                 break;
 465         }
 466         case AF_INET6:
 467                 siphash24_compress_typesafe(a->in_addr.in6, state);
 468
 469                 if (in6_addr_is_null(&a->in_addr.in6))
 470                         siphash24_compress_typesafe(a->prefixlen, state);
 471                 break;
 472
 473         default:
 474                 /* treat any other address family as AF_UNSPEC */
 475                 break;
 476         }
 477 }
 478
 479 static int address_compare_func(const Address *a1, const Address *a2) {
 480         int r;
 481
 482         r = CMP(a1->family, a2->family);
 483         if (r != 0)
 484                 return r;
 485
 486         switch (a1->family) {
 487         case AF_INET: {
 488                 struct in_addr p1, p2;
 489
 490                 /* See kernel's find_matching_ifa() in net/ipv4/devinet.c */
 491                 r = CMP(a1->prefixlen, a2->prefixlen);
 492                 if (r != 0)
 493                         return r;
 494
 495                 assert_se(address_ipv4_prefix(a1, &p1) >= 0);
 496                 assert_se(address_ipv4_prefix(a2, &p2) >= 0);
 497                 r = memcmp(&p1, &p2, sizeof(p1));
 498                 if (r != 0)
 499                         return r;
 500
 501                 return memcmp(&a1->in_addr.in, &a2->in_addr.in, sizeof(a1->in_addr.in));
 502         }
 503         case AF_INET6:
 504                 /* See kernel's ipv6_get_ifaddr() in net/ipv6/addrconf.c */
 505                 r = memcmp(&a1->in_addr.in6, &a2->in_addr.in6, sizeof(a1->in_addr.in6));
 506                 if (r != 0)
 507                         return r;
 508
 509                 /* To distinguish IPv6 null addresses with different prefixlen, e.g. ::48 vs ::64, let's
 510                  * compare the prefix length. */
 511                 if (in6_addr_is_null(&a1->in_addr.in6))
 512                         r = CMP(a1->prefixlen, a2->prefixlen);
 513
 514                 return r;
 515
 516         default:
 517                 /* treat any other address family as AF_UNSPEC */
 518                 return 0;
 519         }
 520 }
 521
 522 bool address_can_update(const Address *existing, const Address *requesting) {
 523         assert(existing);
 524         assert(requesting);
 525
 526         /*
 527          * property     |    IPv4     |  IPv6
 528          * -----------------------------------------
 529          * family       |      ✗      |     ✗
 530          * prefixlen    |      ✗      |     ✗
 531          * address      |      ✗      |     ✗
 532          * scope        |      ✗      |     -
 533          * label        |      ✗      |     -
 534          * broadcast    |      ✗      |     -
 535          * peer         |      ✗      |     ✓
 536          * flags        |      ✗      |     ✓
 537          * lifetime     |      ✓      |     ✓
 538          * route metric |      ✓      |     ✓
 539          * protocol     |      ✓      |     ✓
 540          *
 541          * ✗ : cannot be changed
 542          * ✓ : can be changed
 543          * - : unused
 544          *
 545          * IPv4 : See inet_rtm_newaddr() in net/ipv4/devinet.c.
 546          * IPv6 : See inet6_addr_modify() in net/ipv6/addrconf.c.
 547          */
 548
 549         if (existing->family != requesting->family)
 550                 return false;
 551
 552         if (existing->prefixlen != requesting->prefixlen)
 553                 return false;
 554
 555         /* When a null address is requested, the address to be assigned/updated will be determined later. */
 556         if (!address_is_static_null(requesting) &&
 557             in_addr_equal(existing->family, &existing->in_addr, &requesting->in_addr) <= 0)
 558                 return false;
 559
 560         switch (existing->family) {
 561         case AF_INET: {
 562                 struct in_addr bcast;
 563
 564                 if (existing->scope != requesting->scope)
 565                         return false;
 566                 if (((existing->flags ^ requesting->flags) & KNOWN_FLAGS & ~IPV6ONLY_FLAGS & ~UNMANAGED_FLAGS) != 0)
 567                         return false;
 568                 if (!streq_ptr(existing->label, requesting->label))
 569                         return false;
 570                 if (!in4_addr_equal(&existing->in_addr_peer.in, &requesting->in_addr_peer.in))
 571                         return false;
 572                 if (existing->link && address_get_broadcast(requesting, existing->link, &bcast) >= 0) {
 573                         /* If the broadcast address can be determined now, check if they match. */
 574                         if (!in4_addr_equal(&existing->broadcast, &bcast))
 575                                 return false;
 576                 } else {
 577                         /* When a null address is requested, then the broadcast address will be
 578                          * automatically calculated from the acquired address, e.g.
 579                          *     192.168.0.10/24 -> 192.168.0.255
 580                          * So, here let's only check if the broadcast is the last address in the range, e.g.
 581                          *     0.0.0.0/24 -> 0.0.0.255 */
 582                         if (!FLAGS_SET(existing->broadcast.s_addr, htobe32(UINT32_C(0xffffffff) >> existing->prefixlen)))
 583                                 return false;
 584                 }
 585                 break;
 586         }
 587         case AF_INET6:
 588                 break;
 589
 590         default:
 591                 assert_not_reached();
 592         }
 593
 594         return true;
 595 }
 596
 597 int address_dup(const Address *src, Address **ret) {
 598         _cleanup_(address_unrefp) Address *dest = NULL;
 599         int r;
 600
 601         assert(src);
 602         assert(ret);
 603
 604         dest = newdup(Address, src, 1);
 605         if (!dest)
 606                 return -ENOMEM;
 607
 608         /* clear the reference counter and all pointers */
 609         dest->n_ref = 1;
 610         dest->network = NULL;
 611         dest->section = NULL;
 612         dest->link = NULL;
 613         dest->label = NULL;
 614         dest->token = ipv6_token_ref(src->token);
 615         dest->netlabel = NULL;
 616         dest->nft_set_context.sets = NULL;
 617         dest->nft_set_context.n_sets = 0;
 618
 619         if (src->family == AF_INET) {
 620                 r = strdup_to(&dest->label, src->label);
 621                 if (r < 0)
 622                         return r;
 623         }
 624
 625         r = strdup_to(&dest->netlabel, src->netlabel);
 626         if (r < 0)
 627                 return r;
 628
 629         r = nft_set_context_dup(&src->nft_set_context, &dest->nft_set_context);
 630         if (r < 0)
 631                 return r;
 632
 633         *ret = TAKE_PTR(dest);
 634         return 0;
 635 }
 636
 637 static int address_set_masquerade(Address *address, bool add) {
 638         union in_addr_union masked;
 639         int r;
 640
 641         assert(address);
 642         assert(address->link);
 643
 644         if (!address->link->network)
 645                 return 0;
 646
 647         if (address->family == AF_INET &&
 648             !FLAGS_SET(address->link->network->ip_masquerade, ADDRESS_FAMILY_IPV4))
 649                 return 0;
 650
 651         if (address->family == AF_INET6 &&
 652             !FLAGS_SET(address->link->network->ip_masquerade, ADDRESS_FAMILY_IPV6))
 653                 return 0;
 654
 655         if (address->scope >= RT_SCOPE_LINK)
 656                 return 0;
 657
 658         if (address->ip_masquerade_done == add)
 659                 return 0;
 660
 661         masked = address->in_addr;
 662         r = in_addr_mask(address->family, &masked, address->prefixlen);
 663         if (r < 0)
 664                 return r;
 665
 666         r = fw_add_masquerade(&address->link->manager->fw_ctx, add, address->family, &masked, address->prefixlen);
 667         if (r < 0)
 668                 return r;
 669
 670         address->ip_masquerade_done = add;
 671
 672         return 0;
 673 }
 674
 675 static void address_modify_nft_set_context(Address *address, bool add, NFTSetContext *nft_set_context) {
 676         int r;
 677
 678         assert(address);
 679         assert(address->link);
 680         assert(address->link->manager);
 681         assert(nft_set_context);
 682
 683         if (!address->link->manager->fw_ctx) {
 684                 r = fw_ctx_new_full(&address->link->manager->fw_ctx, /* init_tables= */ false);
 685                 if (r < 0)
 686                         return;
 687         }
 688
 689         FOREACH_ARRAY(nft_set, nft_set_context->sets, nft_set_context->n_sets) {
 690                 uint32_t ifindex;
 691
 692                 assert(nft_set);
 693
 694                 switch (nft_set->source) {
 695                 case NFT_SET_SOURCE_ADDRESS:
 696                         r = nft_set_element_modify_ip(address->link->manager->fw_ctx, add, nft_set->nfproto, address->family, nft_set->table, nft_set->set,
 697                                                       &address->in_addr);
 698                         break;
 699                 case NFT_SET_SOURCE_PREFIX:
 700                         r = nft_set_element_modify_iprange(address->link->manager->fw_ctx, add, nft_set->nfproto, address->family, nft_set->table, nft_set->set,
 701                                                            &address->in_addr, address->prefixlen);
 702                         break;
 703                 case NFT_SET_SOURCE_IFINDEX:
 704                         ifindex = address->link->ifindex;
 705                         r = nft_set_element_modify_any(address->link->manager->fw_ctx, add, nft_set->nfproto, nft_set->table, nft_set->set,
 706                                                        &ifindex, sizeof(ifindex));
 707                         break;
 708                 default:
 709                         assert_not_reached();
 710                 }
 711
 712                 if (r < 0)
 713                         log_warning_errno(r, "Failed to %s NFT set: family %s, table %s, set %s, IP address %s, ignoring: %m",
 714                                           add ? "add" : "delete",
 715                                           nfproto_to_string(nft_set->nfproto), nft_set->table, nft_set->set,
 716                                           IN_ADDR_PREFIX_TO_STRING(address->family, &address->in_addr, address->prefixlen));
 717                 else
 718                         log_debug("%s NFT set: family %s, table %s, set %s, IP address %s",
 719                                   add ? "Added" : "Deleted",
 720                                   nfproto_to_string(nft_set->nfproto), nft_set->table, nft_set->set,
 721                                   IN_ADDR_PREFIX_TO_STRING(address->family, &address->in_addr, address->prefixlen));
 722         }
 723 }
 724
 725 static void address_modify_nft_set(Address *address, bool add) {
 726         assert(address);
 727         assert(address->link);
 728
 729         if (!IN_SET(address->family, AF_INET, AF_INET6))
 730                 return;
 731
 732         if (!address->link->network)
 733                 return;
 734
 735         switch (address->source) {
 736         case NETWORK_CONFIG_SOURCE_DHCP4:
 737                 return address_modify_nft_set_context(address, add, &address->link->network->dhcp_nft_set_context);
 738         case NETWORK_CONFIG_SOURCE_DHCP6:
 739                 return address_modify_nft_set_context(address, add, &address->link->network->dhcp6_nft_set_context);
 740         case NETWORK_CONFIG_SOURCE_DHCP_PD:
 741                 return address_modify_nft_set_context(address, add, &address->link->network->dhcp_pd_nft_set_context);
 742         case NETWORK_CONFIG_SOURCE_NDISC:
 743                 return address_modify_nft_set_context(address, add, &address->link->network->ndisc_nft_set_context);
 744         case NETWORK_CONFIG_SOURCE_STATIC:
 745                 return address_modify_nft_set_context(address, add, &address->nft_set_context);
 746         default:
 747                 return;
 748         }
 749 }
 750
 751 static int address_attach(Link *link, Address *address) {
 752         int r;
 753
 754         assert(link);
 755         assert(address);
 756         assert(!address->link);
 757
 758         r = set_ensure_put(&link->addresses, &address_hash_ops_detach, address);
 759         if (r < 0)
 760                 return r;
 761         if (r == 0)
 762                 return -EEXIST;
 763
 764         address->link = link;
 765         address_ref(address);
 766         return 0;
 767 }
 768
 769 static int address_update(Address *address) {
 770         Link *link = ASSERT_PTR(ASSERT_PTR(address)->link);
 771         int r;
 772
 773         if (address_is_ready(address) &&
 774             address->family == AF_INET6 &&
 775             in6_addr_is_link_local(&address->in_addr.in6) &&
 776             in6_addr_is_null(&link->ipv6ll_address)) {
 777
 778                 link->ipv6ll_address = address->in_addr.in6;
 779
 780                 r = link_ipv6ll_gained(link);
 781                 if (r < 0)
 782                         return r;
 783         }
 784
 785         if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
 786                 return 0;
 787
 788         r = address_set_masquerade(address, /* add = */ true);
 789         if (r < 0)
 790                 return log_link_warning_errno(link, r, "Could not enable IP masquerading: %m");
 791
 792         address_add_netlabel(address);
 793
 794         address_modify_nft_set(address, /* add = */ true);
 795
 796         if (address_is_ready(address) && address->callback) {
 797                 r = address->callback(address);
 798                 if (r < 0)
 799                         return r;
 800         }
 801
 802         link_update_operstate(link, /* also_update_master = */ true);
 803         link_check_ready(link);
 804         return 0;
 805 }
 806
 807 static int address_removed_maybe_kernel_dad(Link *link, Address *address) {
 808         int r;
 809
 810         assert(link);
 811         assert(address);
 812
 813         if (!IN_SET(link->state, LINK_STATE_CONFIGURING, LINK_STATE_CONFIGURED))
 814                 return 0;
 815
 816         if (address->family != AF_INET6)
 817                 return 0;
 818
 819         if (!FLAGS_SET(address->flags, IFA_F_TENTATIVE))
 820                 return 0;
 821
 822         log_link_info(link, "Address %s with tentative flag is removed, maybe a duplicated address is assigned on another node or link?",
 823                       IN6_ADDR_TO_STRING(&address->in_addr.in6));
 824
 825         /* Reset the address state, as the object may be reused in the below. */
 826         address->state = 0;
 827
 828         switch (address->source) {
 829         case NETWORK_CONFIG_SOURCE_STATIC:
 830                 r = link_reconfigure_radv_address(address, link);
 831                 break;
 832         case NETWORK_CONFIG_SOURCE_DHCP_PD:
 833                 r = dhcp_pd_reconfigure_address(address, link);
 834                 break;
 835         case NETWORK_CONFIG_SOURCE_NDISC:
 836                 r = ndisc_reconfigure_address(address, link);
 837                 break;
 838         default:
 839                 r = 0;
 840         }
 841         if (r < 0)
 842                 return log_link_warning_errno(link, r, "Failed to configure an alternative address: %m");
 843
 844         return 0;
 845 }
 846
 847 static int address_drop(Address *in, bool removed_by_us) {
 848         _cleanup_(address_unrefp) Address *address = address_ref(ASSERT_PTR(in));
 849         Link *link = ASSERT_PTR(address->link);
 850         int r;
 851
 852         r = address_set_masquerade(address, /* add = */ false);
 853         if (r < 0)
 854                 log_link_warning_errno(link, r, "Failed to disable IP masquerading, ignoring: %m");
 855
 856         address_modify_nft_set(address, /* add = */ false);
 857
 858         address_del_netlabel(address);
 859
 860         /* FIXME: if the IPv6LL address is dropped, stop DHCPv6, NDISC, RADV. */
 861         if (address->family == AF_INET6 &&
 862             in6_addr_equal(&address->in_addr.in6, &link->ipv6ll_address))
 863                 link->ipv6ll_address = (const struct in6_addr) {};
 864
 865         ipv4acd_detach(link, address);
 866
 867         address_detach(address);
 868
 869         if (!removed_by_us) {
 870                 r = address_removed_maybe_kernel_dad(link, address);
 871                 if (r < 0) {
 872                         link_enter_failed(link);
 873                         return r;
 874                 }
 875         }
 876
 877         link_update_operstate(link, /* also_update_master = */ true);
 878         link_check_ready(link);
 879         return 0;
 880 }
 881
 882 static bool address_match_null(const Address *a, const Address *null_address) {
 883         assert(a);
 884         assert(null_address);
 885
 886         if (!a->requested_as_null)
 887                 return false;
 888
 889         /* Currently, null address is supported only by static addresses. Note that static
 890          * address may be set as foreign during reconfiguring the interface. */
 891         if (!IN_SET(a->source, NETWORK_CONFIG_SOURCE_FOREIGN, NETWORK_CONFIG_SOURCE_STATIC))
 892                 return false;
 893
 894         if (a->family != null_address->family)
 895                 return false;
 896
 897         if (a->prefixlen != null_address->prefixlen)
 898                 return false;
 899
 900         return true;
 901 }
 902
 903 static int address_get_request(Link *link, const Address *address, Request **ret) {
 904         Request *req;
 905
 906         assert(link);
 907         assert(link->manager);
 908         assert(address);
 909
 910         req = ordered_set_get(
 911                         link->manager->request_queue,
 912                         &(Request) {
 913                                 .link = link,
 914                                 .type = REQUEST_TYPE_ADDRESS,
 915                                 .userdata = (void*) address,
 916                                 .hash_func = (hash_func_t) address_hash_func,
 917                                 .compare_func = (compare_func_t) address_compare_func,
 918                         });
 919         if (req) {
 920                 if (ret)
 921                         *ret = req;
 922                 return 0;
 923         }
 924
 925         if (address_is_static_null(address))
 926                 ORDERED_SET_FOREACH(req, link->manager->request_queue) {
 927                         if (req->link != link)
 928                                 continue;
 929                         if (req->type != REQUEST_TYPE_ADDRESS)
 930                                 continue;
 931
 932                         if (!address_match_null(req->userdata, address))
 933                                 continue;
 934
 935                         if (ret)
 936                                 *ret = req;
 937
 938                         return 0;
 939                 }
 940
 941         return -ENOENT;
 942 }
 943
 944 int address_get(Link *link, const Address *in, Address **ret) {
 945         Address *a;
 946
 947         assert(link);
 948         assert(in);
 949
 950         a = set_get(link->addresses, in);
 951         if (a) {
 952                 if (ret)
 953                         *ret = a;
 954                 return 0;
 955         }
 956
 957         /* Find matching address that originally requested as null address. */
 958         if (address_is_static_null(in))
 959                 SET_FOREACH(a, link->addresses) {
 960                         if (!address_match_null(a, in))
 961                                 continue;
 962
 963                         if (ret)
 964                                 *ret = a;
 965                         return 0;
 966                 }
 967
 968         return -ENOENT;
 969 }
 970
 971 int address_get_harder(Link *link, const Address *in, Address **ret) {
 972         Request *req;
 973         int r;
 974
 975         assert(link);
 976         assert(in);
 977
 978         if (address_get(link, in, ret) >= 0)
 979                 return 0;
 980
 981         r = address_get_request(link, in, &req);
 982         if (r < 0)
 983                 return r;
 984
 985         if (ret)
 986                 *ret = ASSERT_PTR(req->userdata);
 987
 988         return 0;
 989 }
 990
 991 int link_get_address(Link *link, int family, const union in_addr_union *address, unsigned char prefixlen, Address **ret) {
 992         Address *a;
 993         int r;
 994
 995         assert(link);
 996         assert(IN_SET(family, AF_INET, AF_INET6));
 997         assert(address);
 998
 999         /* This find an Address object on the link which matches the given address and prefix length
1000          * and does not have peer address. When the prefixlen is zero, then an Address object with an
1001          * arbitrary prefixlen will be returned. */
1002
1003         if (family == AF_INET6 || prefixlen != 0) {
1004                 _cleanup_(address_unrefp) Address *tmp = NULL;
1005
1006                 /* In this case, we can use address_get(). */
1007
1008                 r = address_new(&tmp);
1009                 if (r < 0)
1010                         return r;
1011
1012                 tmp->family = family;
1013                 tmp->in_addr = *address;
1014                 tmp->prefixlen = prefixlen;
1015
1016                 r = address_get(link, tmp, &a);
1017                 if (r < 0)
1018                         return r;
1019
1020                 if (family == AF_INET6) {
1021                         /* IPv6 addresses are managed without peer address and prefix length. Hence, we need
1022                          * to check them explicitly. */
1023                         if (in_addr_is_set(family, &a->in_addr_peer))
1024                                 return -ENOENT;
1025                         if (prefixlen != 0 && a->prefixlen != prefixlen)
1026                                 return -ENOENT;
1027                 }
1028
1029                 if (ret)
1030                         *ret = a;
1031
1032                 return 0;
1033         }
1034
1035         SET_FOREACH(a, link->addresses) {
1036                 if (a->family != family)
1037                         continue;
1038
1039                 if (!in_addr_equal(family, &a->in_addr, address))
1040                         continue;
1041
1042                 if (in_addr_is_set(family, &a->in_addr_peer))
1043                         continue;
1044
1045                 if (ret)
1046                         *ret = a;
1047
1048                 return 0;
1049         }
1050
1051         return -ENOENT;
1052 }
1053
1054 int manager_get_address(Manager *manager, int family, const union in_addr_union *address, unsigned char prefixlen, Address **ret) {
1055         Link *link;
1056
1057         assert(manager);
1058         assert(IN_SET(family, AF_INET, AF_INET6));
1059         assert(address);
1060
1061         HASHMAP_FOREACH(link, manager->links_by_index) {
1062                 if (!IN_SET(link->state, LINK_STATE_CONFIGURING, LINK_STATE_CONFIGURED))
1063                         continue;
1064
1065                 if (link_get_address(link, family, address, prefixlen, ret) >= 0)
1066                         return 0;
1067         }
1068
1069         return -ENOENT;
1070 }
1071
1072 bool manager_has_address(Manager *manager, int family, const union in_addr_union *address) {
1073         Address *a;
1074
1075         assert(manager);
1076         assert(IN_SET(family, AF_INET, AF_INET6));
1077         assert(address);
1078
1079         if (manager_get_address(manager, family, address, 0, &a) < 0)
1080                 return false;
1081
1082         return address_is_ready(a);
1083 }
1084
1085 const char* format_lifetime(char *buf, size_t l, usec_t lifetime_usec) {
1086         assert(buf);
1087         assert(l > 4);
1088
1089         if (lifetime_usec == USEC_INFINITY)
1090                 return "forever";
1091
1092         sprintf(buf, "for ");
1093         /* format_timespan() never fails */
1094         assert_se(format_timespan(buf + 4, l - 4, usec_sub_unsigned(lifetime_usec, now(CLOCK_BOOTTIME)), USEC_PER_SEC));
1095         return buf;
1096 }
1097
1098 static void log_address_debug(const Address *address, const char *str, const Link *link) {
1099         _cleanup_free_ char *state = NULL, *flags_str = NULL, *scope_str = NULL;
1100
1101         assert(address);
1102         assert(str);
1103         assert(link);
1104
1105         if (!DEBUG_LOGGING)
1106                 return;
1107
1108         (void) network_config_state_to_string_alloc(address->state, &state);
1109
1110         const char *peer = in_addr_is_set(address->family, &address->in_addr_peer) ?
1111                 IN_ADDR_TO_STRING(address->family, &address->in_addr_peer) : NULL;
1112
1113         const char *broadcast = (address->family == AF_INET && in4_addr_is_set(&address->broadcast)) ?
1114                 IN4_ADDR_TO_STRING(&address->broadcast) : NULL;
1115
1116         (void) address_flags_to_string_alloc(address->flags, address->family, &flags_str);
1117         (void) route_scope_to_string_alloc(address->scope, &scope_str);
1118
1119         log_link_debug(link, "%s %s address (%s): %s%s%s/%u%s%s (valid %s, preferred %s), flags: %s, scope: %s%s%s",
1120                        str, strna(network_config_source_to_string(address->source)), strna(state),
1121                        IN_ADDR_TO_STRING(address->family, &address->in_addr),
1122                        peer ? " peer " : "", strempty(peer), address->prefixlen,
1123                        broadcast ? " broadcast " : "", strempty(broadcast),
1124                        FORMAT_LIFETIME(address->lifetime_valid_usec),
1125                        FORMAT_LIFETIME(address->lifetime_preferred_usec),
1126                        strna(flags_str), strna(scope_str),
1127                        address->family == AF_INET ? ", label: " : "",
1128                        address->family == AF_INET ? strna(address->label) : "");
1129 }
1130
1131 static int address_set_netlink_message(const Address *address, sd_netlink_message *m, Link *link) {
1132         uint32_t flags;
1133         int r;
1134
1135         assert(address);
1136         assert(m);
1137         assert(link);
1138
1139         r = sd_rtnl_message_addr_set_prefixlen(m, address->prefixlen);
1140         if (r < 0)
1141                 return r;
1142
1143         /* On remove, only IFA_F_MANAGETEMPADDR flag for IPv6 addresses are used. But anyway, set all
1144          * flags except tentative flag here unconditionally. Without setting the flag, the template
1145          * addresses generated by kernel will not be removed automatically when the main address is
1146          * removed. */
1147         flags = address->flags & ~IFA_F_TENTATIVE;
1148         r = sd_rtnl_message_addr_set_flags(m, flags & 0xff);
1149         if (r < 0)
1150                 return r;
1151
1152         if ((flags & ~0xff) != 0) {
1153                 r = sd_netlink_message_append_u32(m, IFA_FLAGS, flags);
1154                 if (r < 0)
1155                         return r;
1156         }
1157
1158         r = netlink_message_append_in_addr_union(m, IFA_LOCAL, address->family, &address->in_addr);
1159         if (r < 0)
1160                 return r;
1161
1162         return 0;
1163 }
1164
1165 static int address_remove_handler(sd_netlink *rtnl, sd_netlink_message *m, RemoveRequest *rreq) {
1166         int r;
1167
1168         assert(m);
1169         assert(rreq);
1170
1171         Link *link = ASSERT_PTR(rreq->link);
1172         Address *address = ASSERT_PTR(rreq->userdata);
1173
1174         if (link->state == LINK_STATE_LINGER)
1175                 return 0;
1176
1177         r = sd_netlink_message_get_errno(m);
1178         if (r < 0) {
1179                 log_link_message_full_errno(link, m,
1180                                             (r == -EADDRNOTAVAIL || !address->link) ? LOG_DEBUG : LOG_WARNING,
1181                                             r, "Could not drop address");
1182
1183                 if (address->link) {
1184                         /* If the address cannot be removed, then assume the address is already removed. */
1185                         log_address_debug(address, "Forgetting", link);
1186
1187                         Request *req;
1188                         if (address_get_request(link, address, &req) >= 0)
1189                                 address_enter_removed(req->userdata);
1190
1191                         (void) address_drop(address, /* removed_by_us = */ true);
1192                 }
1193         }
1194
1195         return 1;
1196 }
1197
1198 int address_remove(Address *address, Link *link) {
1199         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
1200         int r;
1201
1202         assert(address);
1203         assert(IN_SET(address->family, AF_INET, AF_INET6));
1204         assert(link);
1205         assert(link->ifindex > 0);
1206         assert(link->manager);
1207         assert(link->manager->rtnl);
1208
1209         /* If the address is remembered, use the remembered object. */
1210         (void) address_get(link, address, &address);
1211
1212         log_address_debug(address, "Removing", link);
1213
1214         r = sd_rtnl_message_new_addr(link->manager->rtnl, &m, RTM_DELADDR,
1215                                      link->ifindex, address->family);
1216         if (r < 0)
1217                 return log_link_warning_errno(link, r, "Could not allocate RTM_DELADDR message: %m");
1218
1219         r = address_set_netlink_message(address, m, link);
1220         if (r < 0)
1221                 return log_link_warning_errno(link, r, "Could not set netlink attributes: %m");
1222
1223         r = link_remove_request_add(link, address, address, link->manager->rtnl, m, address_remove_handler);
1224         if (r < 0)
1225                 return log_link_warning_errno(link, r, "Could not queue rtnetlink message: %m");
1226
1227         address_enter_removing(address);
1228
1229         /* The operational state is determined by address state and carrier state. Hence, if we remove
1230          * an address, the operational state may be changed. */
1231         link_update_operstate(link, true);
1232         return 0;
1233 }
1234
1235 int address_remove_and_cancel(Address *address, Link *link) {
1236         _cleanup_(request_unrefp) Request *req = NULL;
1237         bool waiting = false;
1238
1239         assert(address);
1240         assert(link);
1241         assert(link->manager);
1242
1243         /* If the address is remembered by the link, then use the remembered object. */
1244         (void) address_get(link, address, &address);
1245
1246         /* Cancel the request for the address.  If the request is already called but we have not received the
1247          * notification about the request, then explicitly remove the address. */
1248         if (address_get_request(link, address, &req) >= 0) {
1249                 request_ref(req); /* avoid the request freed by request_detach() */
1250                 waiting = req->waiting_reply;
1251                 request_detach(req);
1252                 address_cancel_requesting(address);
1253         }
1254
1255         /* If we know the address will come or already exists, remove it. */
1256         if (waiting || (address->link && address_exists(address)))
1257                 return address_remove(address, link);
1258
1259         return 0;
1260 }
1261
1262 bool link_address_is_dynamic(const Link *link, const Address *address) {
1263         Route *route;
1264
1265         assert(link);
1266         assert(link->manager);
1267         assert(address);
1268
1269         if (address->lifetime_preferred_usec != USEC_INFINITY)
1270                 return true;
1271
1272         /* Even when the address is leased from a DHCP server, networkd assign the address
1273          * without lifetime when KeepConfiguration=dhcp. So, let's check that we have
1274          * corresponding routes with RTPROT_DHCP. */
1275         SET_FOREACH(route, link->manager->routes) {
1276                 if (route->source != NETWORK_CONFIG_SOURCE_FOREIGN)
1277                         continue;
1278
1279                 /* The route is not assigned yet, or already removed. Ignoring. */
1280                 if (!route_exists(route))
1281                         continue;
1282
1283                 if (route->protocol != RTPROT_DHCP)
1284                         continue;
1285
1286                 if (route->nexthop.ifindex != link->ifindex)
1287                         continue;
1288
1289                 if (address->family != route->family)
1290                         continue;
1291
1292                 if (in_addr_equal(address->family, &address->in_addr, &route->prefsrc))
1293                         return true;
1294         }
1295
1296         return false;
1297 }
1298
1299 int link_drop_ipv6ll_addresses(Link *link) {
1300         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL, *reply = NULL;
1301         int r;
1302
1303         assert(link);
1304         assert(link->manager);
1305         assert(link->manager->rtnl);
1306
1307         /* IPv6LL address may be in the tentative state, and in that case networkd has not received it.
1308          * So, we need to dump all IPv6 addresses. */
1309
1310         if (link_may_have_ipv6ll(link, /* check_multicast = */ false))
1311                 return 0;
1312
1313         r = sd_rtnl_message_new_addr(link->manager->rtnl, &req, RTM_GETADDR, link->ifindex, AF_INET6);
1314         if (r < 0)
1315                 return r;
1316
1317         r = sd_netlink_message_set_request_dump(req, true);
1318         if (r < 0)
1319                 return r;
1320
1321         r = sd_netlink_call(link->manager->rtnl, req, 0, &reply);
1322         if (r < 0)
1323                 return r;
1324
1325         for (sd_netlink_message *addr = reply; addr; addr = sd_netlink_message_next(addr)) {
1326                 _cleanup_(address_unrefp) Address *a = NULL;
1327                 unsigned char flags, prefixlen;
1328                 struct in6_addr address;
1329                 int ifindex;
1330
1331                 /* NETLINK_GET_STRICT_CHK socket option is supported since kernel 4.20. To support
1332                  * older kernels, we need to check ifindex here. */
1333                 r = sd_rtnl_message_addr_get_ifindex(addr, &ifindex);
1334                 if (r < 0) {
1335                         log_link_debug_errno(link, r, "rtnl: received address message without valid ifindex, ignoring: %m");
1336                         continue;
1337                 } else if (link->ifindex != ifindex)
1338                         continue;
1339
1340                 r = sd_rtnl_message_addr_get_flags(addr, &flags);
1341                 if (r < 0) {
1342                         log_link_debug_errno(link, r, "rtnl: received address message without valid flags, ignoring: %m");
1343                         continue;
1344                 }
1345
1346                 r = sd_rtnl_message_addr_get_prefixlen(addr, &prefixlen);
1347                 if (r < 0) {
1348                         log_link_debug_errno(link, r, "rtnl: received address message without prefixlen, ignoring: %m");
1349                         continue;
1350                 }
1351
1352                 if (sd_netlink_message_read_in6_addr(addr, IFA_LOCAL, NULL) >= 0)
1353                         /* address with peer, ignoring. */
1354                         continue;
1355
1356                 r = sd_netlink_message_read_in6_addr(addr, IFA_ADDRESS, &address);
1357                 if (r < 0) {
1358                         log_link_debug_errno(link, r, "rtnl: received address message without valid address, ignoring: %m");
1359                         continue;
1360                 }
1361
1362                 if (!in6_addr_is_link_local(&address))
1363                          continue;
1364
1365                 r = address_new(&a);
1366                 if (r < 0)
1367                         return -ENOMEM;
1368
1369                 a->family = AF_INET6;
1370                 a->in_addr.in6 = address;
1371                 a->prefixlen = prefixlen;
1372                 a->flags = flags;
1373
1374                 r = address_remove(a, link);
1375                 if (r < 0)
1376                         return r;
1377         }
1378
1379         return 0;
1380 }
1381
1382 int link_drop_foreign_addresses(Link *link) {
1383         Address *address;
1384         int r = 0;
1385
1386         assert(link);
1387         assert(link->network);
1388
1389         /* First, mark all addresses. */
1390         SET_FOREACH(address, link->addresses) {
1391                 /* We consider IPv6LL addresses to be managed by the kernel, or dropped in link_drop_ipv6ll_addresses() */
1392                 if (address->family == AF_INET6 && in6_addr_is_link_local(&address->in_addr.in6))
1393                         continue;
1394
1395                 /* Do not remove localhost address (127.0.0.1 and ::1) */
1396                 if (link->flags & IFF_LOOPBACK && in_addr_is_localhost_one(address->family, &address->in_addr) > 0)
1397                         continue;
1398
1399                 /* Ignore addresses we configured. */
1400                 if (address->source != NETWORK_CONFIG_SOURCE_FOREIGN)
1401                         continue;
1402
1403                 /* Ignore addresses not assigned yet or already removing. */
1404                 if (!address_exists(address))
1405                         continue;
1406
1407                 /* link_address_is_dynamic() is slightly heavy. Let's call the function only when KeepConfiguration= is set. */
1408                 if (IN_SET(link->network->keep_configuration, KEEP_CONFIGURATION_DHCP, KEEP_CONFIGURATION_STATIC) &&
1409                     link_address_is_dynamic(link, address) == (link->network->keep_configuration == KEEP_CONFIGURATION_DHCP))
1410                         continue;
1411
1412                 address_mark(address);
1413         }
1414
1415         /* Then, unmark requested addresses. */
1416         ORDERED_HASHMAP_FOREACH(address, link->network->addresses_by_section) {
1417                 Address *existing;
1418
1419                 if (address_get(link, address, &existing) < 0)
1420                         continue;
1421
1422                 if (!address_can_update(existing, address))
1423                         continue;
1424
1425                 /* Found matching static configuration. Keep the existing address. */
1426                 address_unmark(existing);
1427         }
1428
1429         /* Finally, remove all marked addresses. */
1430         SET_FOREACH(address, link->addresses) {
1431                 if (!address_is_marked(address))
1432                         continue;
1433
1434                 RET_GATHER(r, address_remove(address, link));
1435         }
1436
1437         return r;
1438 }
1439
1440 int link_drop_static_addresses(Link *link) {
1441         Address *address;
1442         int r = 0;
1443
1444         assert(link);
1445
1446         SET_FOREACH(address, link->addresses) {
1447                 /* Remove only static addresses here. Dynamic addresses will be removed e.g. on lease
1448                  * expiration or stopping the DHCP client. */
1449                 if (address->source != NETWORK_CONFIG_SOURCE_STATIC)
1450                         continue;
1451
1452                 /* Ignore addresses not assigned yet or already removing. */
1453                 if (!address_exists(address))
1454                         continue;
1455
1456                 RET_GATHER(r, address_remove(address, link));
1457         }
1458
1459         return r;
1460 }
1461
1462 void link_foreignize_addresses(Link *link) {
1463         Address *address;
1464
1465         assert(link);
1466
1467         SET_FOREACH(address, link->addresses)
1468                 address->source = NETWORK_CONFIG_SOURCE_FOREIGN;
1469 }
1470
1471 int address_configure_handler_internal(sd_netlink *rtnl, sd_netlink_message *m, Link *link, const char *error_msg) {
1472         int r;
1473
1474         assert(rtnl);
1475         assert(m);
1476         assert(link);
1477         assert(error_msg);
1478
1479         r = sd_netlink_message_get_errno(m);
1480         if (r < 0 && r != -EEXIST) {
1481                 log_link_message_warning_errno(link, m, r, error_msg);
1482                 link_enter_failed(link);
1483                 return 0;
1484         }
1485
1486         return 1;
1487 }
1488
1489 static int address_configure(const Address *address, const struct ifa_cacheinfo *c, Link *link, Request *req) {
1490         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
1491         int r;
1492
1493         assert(address);
1494         assert(IN_SET(address->family, AF_INET, AF_INET6));
1495         assert(c);
1496         assert(link);
1497         assert(link->ifindex > 0);
1498         assert(link->manager);
1499         assert(link->manager->rtnl);
1500         assert(req);
1501
1502         log_address_debug(address, "Configuring", link);
1503
1504         r = sd_rtnl_message_new_addr_update(link->manager->rtnl, &m, link->ifindex, address->family);
1505         if (r < 0)
1506                 return r;
1507
1508         r = address_set_netlink_message(address, m, link);
1509         if (r < 0)
1510                 return r;
1511
1512         r = sd_rtnl_message_addr_set_scope(m, address->scope);
1513         if (r < 0)
1514                 return r;
1515
1516         if (address->family == AF_INET6 || in_addr_is_set(address->family, &address->in_addr_peer)) {
1517                 r = netlink_message_append_in_addr_union(m, IFA_ADDRESS, address->family, &address->in_addr_peer);
1518                 if (r < 0)
1519                         return r;
1520         } else if (in4_addr_is_set(&address->broadcast)) {
1521                 r = sd_netlink_message_append_in_addr(m, IFA_BROADCAST, &address->broadcast);
1522                 if (r < 0)
1523                         return r;
1524         }
1525
1526         if (address->family == AF_INET && address->label) {
1527                 r = sd_netlink_message_append_string(m, IFA_LABEL, address->label);
1528                 if (r < 0)
1529                         return r;
1530         }
1531
1532         r = sd_netlink_message_append_cache_info(m, IFA_CACHEINFO, c);
1533         if (r < 0)
1534                 return r;
1535
1536         r = sd_netlink_message_append_u32(m, IFA_RT_PRIORITY, address->route_metric);
1537         if (r < 0)
1538                 return r;
1539
1540         return request_call_netlink_async(link->manager->rtnl, m, req);
1541 }
1542
1543 static int address_acquire(Link *link, const Address *address, union in_addr_union *ret) {
1544         union in_addr_union a;
1545         int r;
1546
1547         assert(link);
1548         assert(address);
1549         assert(ret);
1550
1551         r = address_acquire_from_dhcp_server_leases_file(link, address, ret);
1552         if (!IN_SET(r, -ENOENT, -ENXIO, -EINVAL))
1553                 return r;
1554
1555         r = address_pool_acquire(link->manager, address->family, address->prefixlen, &a);
1556         if (r < 0)
1557                 return r;
1558         if (r == 0)
1559                 return -EBUSY;
1560
1561         /* Pick first address in range for ourselves. */
1562         if (address->family == AF_INET)
1563                 a.in.s_addr |= htobe32(1);
1564         else if (address->family == AF_INET6)
1565                 a.in6.s6_addr[15] |= 1;
1566         else
1567                 assert_not_reached();
1568
1569         *ret = a;
1570         return 0;
1571 }
1572
1573 static int address_requeue_request(Request *req, Link *link, const Address *address) {
1574         int r;
1575
1576         assert(req);
1577         assert(link);
1578         assert(link->manager);
1579         assert(link->network);
1580         assert(address);
1581
1582         /* Something useful was configured? just use it */
1583         if (in_addr_is_set(address->family, &address->in_addr))
1584                 return 0;
1585
1586         /* The address is configured to be 0.0.0.0 or [::] by the user?
1587          * Then let's acquire something more useful. */
1588         union in_addr_union a;
1589         r = address_acquire(link, address, &a);
1590         if (r < 0)
1591                 return r;
1592
1593         _cleanup_(address_unrefp) Address *tmp = NULL;
1594         r = address_dup(address, &tmp);
1595         if (r < 0)
1596                 return r;
1597
1598         tmp->in_addr = a;
1599
1600         r = link_requeue_request(link, req, tmp, NULL);
1601         if (r < 0)
1602                 return r;
1603         if (r == 0)
1604                 return -EEXIST; /* Already queued?? Strange... */
1605
1606         TAKE_PTR(tmp);
1607         return 1; /* A new request is queued. it is not necessary to process this request anymore. */
1608 }
1609
1610 static int address_process_request(Request *req, Link *link, Address *address) {
1611         Address *existing;
1612         struct ifa_cacheinfo c;
1613         int r;
1614
1615         assert(req);
1616         assert(link);
1617         assert(address);
1618
1619         if (!link_is_ready_to_configure(link, false))
1620                 return 0;
1621
1622         /* Refuse adding more than the limit */
1623         if (set_size(link->addresses) >= ADDRESSES_PER_LINK_MAX)
1624                 return 0;
1625
1626         r = address_requeue_request(req, link, address);
1627         if (r == -EBUSY)
1628                 return 0;
1629         if (r != 0)
1630                 return r;
1631
1632         address_set_broadcast(address, link);
1633
1634         r = ipv4acd_configure(link, address);
1635         if (r < 0)
1636                 return r;
1637
1638         if (!ipv4acd_bound(link, address))
1639                 return 0;
1640
1641         address_set_cinfo(link->manager, address, &c);
1642         if (c.ifa_valid == 0) {
1643                 log_link_debug(link, "Refuse to configure %s address %s, as its valid lifetime is zero.",
1644                                network_config_source_to_string(address->source),
1645                                IN_ADDR_PREFIX_TO_STRING(address->family, &address->in_addr, address->prefixlen));
1646
1647                 address_cancel_requesting(address);
1648                 if (address_get(link, address, &existing) >= 0)
1649                         address_cancel_requesting(existing);
1650                 return 1;
1651         }
1652
1653         r = address_configure(address, &c, link, req);
1654         if (r < 0)
1655                 return log_link_warning_errno(link, r, "Failed to configure address: %m");
1656
1657         address_enter_configuring(address);
1658         if (address_get(link, address, &existing) >= 0)
1659                 address_enter_configuring(existing);
1660
1661         return 1;
1662 }
1663
1664 int link_request_address(
1665                 Link *link,
1666                 const Address *address,
1667                 unsigned *message_counter,
1668                 address_netlink_handler_t netlink_handler,
1669                 Request **ret) {
1670
1671         _cleanup_(address_unrefp) Address *tmp = NULL;
1672         Address *existing = NULL;
1673         int r;
1674
1675         assert(link);
1676         assert(address);
1677         assert(address->source != NETWORK_CONFIG_SOURCE_FOREIGN);
1678
1679         if (address->lifetime_valid_usec == 0)
1680                 /* The requested address is outdated. Let's ignore the request. */
1681                 return 0;
1682
1683         if (address_get_request(link, address, NULL) >= 0)
1684                 return 0; /* already requested, skipping. */
1685
1686         r = address_dup(address, &tmp);
1687         if (r < 0)
1688                 return log_oom();
1689
1690         if (address_get(link, address, &existing) >= 0) {
1691                 /* Copy already assigned address when it is requested as a null address. */
1692                 if (address_is_static_null(address))
1693                         tmp->in_addr = existing->in_addr;
1694
1695                 /* Copy state for logging below. */
1696                 tmp->state = existing->state;
1697         }
1698
1699         log_address_debug(tmp, "Requesting", link);
1700         r = link_queue_request_safe(link, REQUEST_TYPE_ADDRESS,
1701                                     tmp,
1702                                     address_unref,
1703                                     address_hash_func,
1704                                     address_compare_func,
1705                                     address_process_request,
1706                                     message_counter, netlink_handler, ret);
1707         if (r < 0)
1708                 return log_link_warning_errno(link, r, "Failed to request address: %m");
1709         if (r == 0)
1710                 return 0;
1711
1712         address_enter_requesting(tmp);
1713         if (existing)
1714                 address_enter_requesting(existing);
1715
1716         TAKE_PTR(tmp);
1717         return 1;
1718 }
1719
1720 static int static_address_handler(sd_netlink *rtnl, sd_netlink_message *m, Request *req, Link *link, Address *address) {
1721         int r;
1722
1723         assert(link);
1724
1725         r = address_configure_handler_internal(rtnl, m, link, "Failed to set static address");
1726         if (r <= 0)
1727                 return r;
1728
1729         if (link->static_address_messages == 0) {
1730                 log_link_debug(link, "Addresses set");
1731                 link->static_addresses_configured = true;
1732                 link_check_ready(link);
1733         }
1734
1735         return 1;
1736 }
1737
1738 int link_request_static_address(Link *link, const Address *address) {
1739         assert(link);
1740         assert(address);
1741         assert(address->source == NETWORK_CONFIG_SOURCE_STATIC);
1742
1743         return link_request_address(link, address, &link->static_address_messages,
1744                                     static_address_handler, NULL);
1745 }
1746
1747 int link_request_static_addresses(Link *link) {
1748         Address *a;
1749         int r;
1750
1751         assert(link);
1752         assert(link->network);
1753
1754         link->static_addresses_configured = false;
1755
1756         ORDERED_HASHMAP_FOREACH(a, link->network->addresses_by_section) {
1757                 r = link_request_static_address(link, a);
1758                 if (r < 0)
1759                         return r;
1760         }
1761
1762         r = link_request_radv_addresses(link);
1763         if (r < 0)
1764                 return r;
1765
1766         if (link->static_address_messages == 0) {
1767                 link->static_addresses_configured = true;
1768                 link_check_ready(link);
1769         } else {
1770                 log_link_debug(link, "Setting addresses");
1771                 link_set_state(link, LINK_STATE_CONFIGURING);
1772         }
1773
1774         return 0;
1775 }
1776
1777 int manager_rtnl_process_address(sd_netlink *rtnl, sd_netlink_message *message, Manager *m) {
1778         _cleanup_(address_unrefp) Address *tmp = NULL;
1779         struct ifa_cacheinfo cinfo;
1780         Link *link;
1781         uint16_t type;
1782         Address *address = NULL;
1783         Request *req = NULL;
1784         bool is_new = false, update_dhcp4;
1785         int ifindex, r;
1786
1787         assert(rtnl);
1788         assert(message);
1789         assert(m);
1790
1791         if (sd_netlink_message_is_error(message)) {
1792                 r = sd_netlink_message_get_errno(message);
1793                 if (r < 0)
1794                         log_message_warning_errno(message, r, "rtnl: failed to receive address message, ignoring");
1795
1796                 return 0;
1797         }
1798
1799         r = sd_netlink_message_get_type(message, &type);
1800         if (r < 0) {
1801                 log_warning_errno(r, "rtnl: could not get message type, ignoring: %m");
1802                 return 0;
1803         } else if (!IN_SET(type, RTM_NEWADDR, RTM_DELADDR)) {
1804                 log_warning("rtnl: received unexpected message type %u when processing address, ignoring.", type);
1805                 return 0;
1806         }
1807
1808         r = sd_rtnl_message_addr_get_ifindex(message, &ifindex);
1809         if (r < 0) {
1810                 log_warning_errno(r, "rtnl: could not get ifindex from message, ignoring: %m");
1811                 return 0;
1812         } else if (ifindex <= 0) {
1813                 log_warning("rtnl: received address message with invalid ifindex %d, ignoring.", ifindex);
1814                 return 0;
1815         }
1816
1817         r = link_get_by_index(m, ifindex, &link);
1818         if (r < 0) {
1819                 /* when enumerating we might be out of sync, but we will get the address again, so just
1820                  * ignore it */
1821                 if (!m->enumerating)
1822                         log_warning("rtnl: received address for link '%d' we don't know about, ignoring.", ifindex);
1823                 return 0;
1824         }
1825
1826         r = address_new(&tmp);
1827         if (r < 0)
1828                 return log_oom();
1829
1830         /* First, read minimal information to make address_get() work below. */
1831
1832         r = sd_rtnl_message_addr_get_family(message, &tmp->family);
1833         if (r < 0) {
1834                 log_link_warning(link, "rtnl: received address message without family, ignoring.");
1835                 return 0;
1836         } else if (!IN_SET(tmp->family, AF_INET, AF_INET6)) {
1837                 log_link_debug(link, "rtnl: received address message with invalid family '%i', ignoring.", tmp->family);
1838                 return 0;
1839         }
1840
1841         r = sd_rtnl_message_addr_get_prefixlen(message, &tmp->prefixlen);
1842         if (r < 0) {
1843                 log_link_warning_errno(link, r, "rtnl: received address message without prefixlen, ignoring: %m");
1844                 return 0;
1845         }
1846
1847         switch (tmp->family) {
1848         case AF_INET:
1849                 r = sd_netlink_message_read_in_addr(message, IFA_LOCAL, &tmp->in_addr.in);
1850                 if (r < 0) {
1851                         log_link_warning_errno(link, r, "rtnl: received address message without valid address, ignoring: %m");
1852                         return 0;
1853                 }
1854
1855                 r = sd_netlink_message_read_in_addr(message, IFA_ADDRESS, &tmp->in_addr_peer.in);
1856                 if (r < 0 && r != -ENODATA) {
1857                         log_link_warning_errno(link, r, "rtnl: could not get peer address from address message, ignoring: %m");
1858                         return 0;
1859                 } else if (r >= 0) {
1860                         if (in4_addr_equal(&tmp->in_addr.in, &tmp->in_addr_peer.in))
1861                                 tmp->in_addr_peer = IN_ADDR_NULL;
1862                 }
1863
1864                 break;
1865
1866         case AF_INET6:
1867                 r = sd_netlink_message_read_in6_addr(message, IFA_LOCAL, &tmp->in_addr.in6);
1868                 if (r >= 0) {
1869                         /* Have peer address. */
1870                         r = sd_netlink_message_read_in6_addr(message, IFA_ADDRESS, &tmp->in_addr_peer.in6);
1871                         if (r < 0) {
1872                                 log_link_warning_errno(link, r, "rtnl: could not get peer address from address message, ignoring: %m");
1873                                 return 0;
1874                         }
1875                 } else if (r == -ENODATA) {
1876                         /* Does not have peer address. */
1877                         r = sd_netlink_message_read_in6_addr(message, IFA_ADDRESS, &tmp->in_addr.in6);
1878                         if (r < 0) {
1879                                 log_link_warning_errno(link, r, "rtnl: received address message without valid address, ignoring: %m");
1880                                 return 0;
1881                         }
1882                 } else {
1883                         log_link_warning_errno(link, r, "rtnl: could not get local address from address message, ignoring: %m");
1884                         return 0;
1885                 }
1886
1887                 break;
1888
1889         default:
1890                 assert_not_reached();
1891         }
1892
1893         update_dhcp4 = tmp->family == AF_INET6;
1894
1895         /* Then, find the managed Address and Request objects corresponding to the received address. */
1896         (void) address_get(link, tmp, &address);
1897         (void) address_get_request(link, tmp, &req);
1898
1899         if (type == RTM_DELADDR) {
1900                 if (address) {
1901                         bool removed_by_us = FLAGS_SET(address->state, NETWORK_CONFIG_STATE_REMOVING);
1902
1903                         address_enter_removed(address);
1904                         log_address_debug(address, "Forgetting removed", link);
1905                         (void) address_drop(address, removed_by_us);
1906                 } else
1907                         log_address_debug(tmp, "Kernel removed unknown", link);
1908
1909                 if (req)
1910                         address_enter_removed(req->userdata);
1911
1912                 goto finalize;
1913         }
1914
1915         if (!address) {
1916                 /* If we did not know the address, then save it. */
1917                 r = address_attach(link, tmp);
1918                 if (r < 0) {
1919                         log_link_warning_errno(link, r, "Failed to save received address %s, ignoring: %m",
1920                                                IN_ADDR_PREFIX_TO_STRING(tmp->family, &tmp->in_addr, tmp->prefixlen));
1921                         return 0;
1922                 }
1923                 address = tmp;
1924
1925                 is_new = true;
1926
1927         } else {
1928                 /* Otherwise, update the managed Address object with the netlink notification. */
1929                 address->prefixlen = tmp->prefixlen;
1930                 address->in_addr_peer = tmp->in_addr_peer;
1931         }
1932
1933         /* Also update information that cannot be obtained through netlink notification. */
1934         if (req && req->waiting_reply) {
1935                 Address *a = ASSERT_PTR(req->userdata);
1936
1937                 address->source = a->source;
1938                 address->provider = a->provider;
1939                 (void) free_and_strdup_warn(&address->netlabel, a->netlabel);
1940                 nft_set_context_clear(&address->nft_set_context);
1941                 (void) nft_set_context_dup(&a->nft_set_context, &address->nft_set_context);
1942                 address->requested_as_null = a->requested_as_null;
1943                 address->callback = a->callback;
1944
1945                 ipv6_token_ref(a->token);
1946                 ipv6_token_unref(address->token);
1947                 address->token = a->token;
1948         }
1949
1950         /* Then, update miscellaneous info. */
1951         r = sd_rtnl_message_addr_get_scope(message, &address->scope);
1952         if (r < 0)
1953                 log_link_debug_errno(link, r, "rtnl: received address message without scope, ignoring: %m");
1954
1955         if (address->family == AF_INET) {
1956                 _cleanup_free_ char *label = NULL;
1957
1958                 r = sd_netlink_message_read_string_strdup(message, IFA_LABEL, &label);
1959                 if (r >= 0) {
1960                         if (!streq_ptr(label, link->ifname))
1961                                 free_and_replace(address->label, label);
1962                 } else if (r != -ENODATA)
1963                         log_link_debug_errno(link, r, "rtnl: could not get label from address message, ignoring: %m");
1964
1965                 r = sd_netlink_message_read_in_addr(message, IFA_BROADCAST, &address->broadcast);
1966                 if (r < 0 && r != -ENODATA)
1967                         log_link_debug_errno(link, r, "rtnl: could not get broadcast from address message, ignoring: %m");
1968         }
1969
1970         r = sd_netlink_message_read_u32(message, IFA_FLAGS, &address->flags);
1971         if (r == -ENODATA) {
1972                 unsigned char flags;
1973
1974                 /* For old kernels. */
1975                 r = sd_rtnl_message_addr_get_flags(message, &flags);
1976                 if (r >= 0)
1977                         address->flags = flags;
1978         } else if (r < 0)
1979                 log_link_debug_errno(link, r, "rtnl: failed to read IFA_FLAGS attribute, ignoring: %m");
1980
1981         r = sd_netlink_message_read_cache_info(message, IFA_CACHEINFO, &cinfo);
1982         if (r >= 0)
1983                 address_set_lifetime(m, address, &cinfo);
1984         else if (r != -ENODATA)
1985                 log_link_debug_errno(link, r, "rtnl: failed to read IFA_CACHEINFO attribute, ignoring: %m");
1986
1987         r = sd_netlink_message_read_u32(message, IFA_RT_PRIORITY, &address->route_metric);
1988         if (r < 0 && r != -ENODATA)
1989                 log_link_debug_errno(link, r, "rtnl: failed to read IFA_RT_PRIORITY attribute, ignoring: %m");
1990
1991         address_enter_configured(address);
1992         if (req)
1993                 address_enter_configured(req->userdata);
1994
1995         log_address_debug(address, is_new ? "Received new": "Received updated", link);
1996
1997         /* address_update() logs internally, so we don't need to here. */
1998         r = address_update(address);
1999         if (r < 0)
2000                 link_enter_failed(link);
2001
2002 finalize:
2003         if (update_dhcp4) {
2004                 r = dhcp4_update_ipv6_connectivity(link);
2005                 if (r < 0) {
2006                         log_link_warning_errno(link, r, "Failed to notify IPv6 connectivity to DHCPv4 client: %m");
2007                         link_enter_failed(link);
2008                 }
2009         }
2010
2011         return 1;
2012 }
2013
2014 int config_parse_broadcast(
2015                 const char *unit,
2016                 const char *filename,
2017                 unsigned line,
2018                 const char *section,
2019                 unsigned section_line,
2020                 const char *lvalue,
2021                 int ltype,
2022                 const char *rvalue,
2023                 void *data,
2024                 void *userdata) {
2025
2026         Network *network = userdata;
2027         _cleanup_(address_unref_or_set_invalidp) Address *n = NULL;
2028         union in_addr_union u;
2029         int r;
2030
2031         assert(filename);
2032         assert(section);
2033         assert(lvalue);
2034         assert(rvalue);
2035         assert(data);
2036
2037         r = address_new_static(network, filename, section_line, &n);
2038         if (r == -ENOMEM)
2039                 return log_oom();
2040         if (r < 0) {
2041                 log_syntax(unit, LOG_WARNING, filename, line, r,
2042                            "Failed to allocate new address, ignoring assignment: %m");
2043                 return 0;
2044         }
2045
2046         if (isempty(rvalue)) {
2047                 /* The broadcast address will be calculated based on Address=, and set if the link is
2048                  * not a wireguard interface. Here, we do not check or set n->family. */
2049                 n->broadcast = (struct in_addr) {};
2050                 n->set_broadcast = -1;
2051                 TAKE_PTR(n);
2052                 return 0;
2053         }
2054
2055         r = parse_boolean(rvalue);
2056         if (r >= 0) {
2057                 /* The broadcast address will be calculated based on Address=. Here, we do not check or
2058                  * set n->family. */
2059                 n->broadcast = (struct in_addr) {};
2060                 n->set_broadcast = r;
2061                 TAKE_PTR(n);
2062                 return 0;
2063         }
2064
2065         if (n->family == AF_INET6) {
2066                 log_syntax(unit, LOG_WARNING, filename, line, 0,
2067                            "Broadcast is not valid for IPv6 addresses, ignoring assignment: %s", rvalue);
2068                 return 0;
2069         }
2070
2071         r = in_addr_from_string(AF_INET, rvalue, &u);
2072         if (r < 0) {
2073                 log_syntax(unit, LOG_WARNING, filename, line, r,
2074                            "Broadcast is invalid, ignoring assignment: %s", rvalue);
2075                 return 0;
2076         }
2077         if (in4_addr_is_null(&u.in)) {
2078                 log_syntax(unit, LOG_WARNING, filename, line, 0,
2079                            "Broadcast cannot be ANY address, ignoring assignment: %s", rvalue);
2080                 return 0;
2081         }
2082
2083         n->broadcast = u.in;
2084         n->set_broadcast = true;
2085         n->family = AF_INET;
2086         TAKE_PTR(n);
2087
2088         return 0;
2089 }
2090
2091 int config_parse_address(
2092                 const char *unit,
2093                 const char *filename,
2094                 unsigned line,
2095                 const char *section,
2096                 unsigned section_line,
2097                 const char *lvalue,
2098                 int ltype,
2099                 const char *rvalue,
2100                 void *data,
2101                 void *userdata) {
2102
2103         Network *network = userdata;
2104         _cleanup_(address_unref_or_set_invalidp) Address *n = NULL;
2105         union in_addr_union buffer;
2106         unsigned char prefixlen;
2107         int r, f;
2108
2109         assert(filename);
2110         assert(section);
2111         assert(lvalue);
2112         assert(rvalue);
2113         assert(data);
2114
2115         if (streq(section, "Network")) {
2116                 if (isempty(rvalue)) {
2117                         /* If an empty string specified in [Network] section, clear previously assigned addresses. */
2118                         network->addresses_by_section = ordered_hashmap_free(network->addresses_by_section);
2119                         return 0;
2120                 }
2121
2122                 /* we are not in an Address section, so use line number instead. */
2123                 r = address_new_static(network, filename, line, &n);
2124         } else
2125                 r = address_new_static(network, filename, section_line, &n);
2126         if (r == -ENOMEM)
2127                 return log_oom();
2128         if (r < 0) {
2129                 log_syntax(unit, LOG_WARNING, filename, line, r,
2130                            "Failed to allocate new address, ignoring assignment: %m");
2131                 return 0;
2132         }
2133
2134         /* Address=address/prefixlen */
2135         r = in_addr_prefix_from_string_auto_internal(rvalue, PREFIXLEN_REFUSE, &f, &buffer, &prefixlen);
2136         if (r == -ENOANO) {
2137                 r = in_addr_prefix_from_string_auto(rvalue, &f, &buffer, &prefixlen);
2138                 if (r >= 0)
2139                         log_syntax(unit, LOG_WARNING, filename, line, r,
2140                                    "Address '%s' is specified without prefix length. Assuming the prefix length is %u. "
2141                                    "Please specify the prefix length explicitly.", rvalue, prefixlen);
2142         }
2143         if (r < 0) {
2144                 log_syntax(unit, LOG_WARNING, filename, line, r, "Invalid address '%s', ignoring assignment: %m", rvalue);
2145                 return 0;
2146         }
2147
2148         if (n->family != AF_UNSPEC && f != n->family) {
2149                 log_syntax(unit, LOG_WARNING, filename, line, 0, "Address is incompatible, ignoring assignment: %s", rvalue);
2150                 return 0;
2151         }
2152
2153         if (in_addr_is_null(f, &buffer)) {
2154                 /* Will use address from address pool. Note that for ipv6 case, prefix of the address
2155                  * pool is 8, but 40 bit is used by the global ID and 16 bit by the subnet ID. So,
2156                  * let's limit the prefix length to 64 or larger. See RFC4193. */
2157                 if ((f == AF_INET && prefixlen < 8) ||
2158                     (f == AF_INET6 && prefixlen < 64)) {
2159                         log_syntax(unit, LOG_WARNING, filename, line, 0,
2160                                    "Null address with invalid prefixlen='%u', ignoring assignment: %s",
2161                                    prefixlen, rvalue);
2162                         return 0;
2163                 }
2164         }
2165
2166         n->family = f;
2167         n->prefixlen = prefixlen;
2168
2169         if (streq(lvalue, "Address")) {
2170                 n->in_addr = buffer;
2171                 n->requested_as_null = !in_addr_is_set(n->family, &n->in_addr);
2172         } else
2173                 n->in_addr_peer = buffer;
2174
2175         TAKE_PTR(n);
2176         return 0;
2177 }
2178
2179 int config_parse_label(
2180                 const char *unit,
2181                 const char *filename,
2182                 unsigned line,
2183                 const char *section,
2184                 unsigned section_line,
2185                 const char *lvalue,
2186                 int ltype,
2187                 const char *rvalue,
2188                 void *data,
2189                 void *userdata) {
2190
2191         _cleanup_(address_unref_or_set_invalidp) Address *n = NULL;
2192         Network *network = userdata;
2193         int r;
2194
2195         assert(filename);
2196         assert(section);
2197         assert(lvalue);
2198         assert(rvalue);
2199         assert(data);
2200
2201         r = address_new_static(network, filename, section_line, &n);
2202         if (r == -ENOMEM)
2203                 return log_oom();
2204         if (r < 0) {
2205                 log_syntax(unit, LOG_WARNING, filename, line, r,
2206                            "Failed to allocate new address, ignoring assignment: %m");
2207                 return 0;
2208         }
2209
2210         if (isempty(rvalue)) {
2211                 n->label = mfree(n->label);
2212                 TAKE_PTR(n);
2213                 return 0;
2214         }
2215
2216         if (!address_label_valid(rvalue)) {
2217                 log_syntax(unit, LOG_WARNING, filename, line, 0,
2218                            "Interface label is too long or invalid, ignoring assignment: %s", rvalue);
2219                 return 0;
2220         }
2221
2222         r = free_and_strdup(&n->label, rvalue);
2223         if (r < 0)
2224                 return log_oom();
2225
2226         TAKE_PTR(n);
2227         return 0;
2228 }
2229
2230 int config_parse_lifetime(
2231                 const char *unit,
2232                 const char *filename,
2233                 unsigned line,
2234                 const char *section,
2235                 unsigned section_line,
2236                 const char *lvalue,
2237                 int ltype,
2238                 const char *rvalue,
2239                 void *data,
2240                 void *userdata) {
2241
2242         Network *network = userdata;
2243         _cleanup_(address_unref_or_set_invalidp) Address *n = NULL;
2244         usec_t k;
2245         int r;
2246
2247         assert(filename);
2248         assert(section);
2249         assert(lvalue);
2250         assert(rvalue);
2251         assert(data);
2252
2253         r = address_new_static(network, filename, section_line, &n);
2254         if (r == -ENOMEM)
2255                 return log_oom();
2256         if (r < 0) {
2257                 log_syntax(unit, LOG_WARNING, filename, line, r,
2258                            "Failed to allocate new address, ignoring assignment: %m");
2259                 return 0;
2260         }
2261
2262         /* We accept only "forever", "infinity", empty, or "0". */
2263         if (STR_IN_SET(rvalue, "forever", "infinity", ""))
2264                 k = USEC_INFINITY;
2265         else if (streq(rvalue, "0"))
2266                 k = 0;
2267         else {
2268                 log_syntax(unit, LOG_WARNING, filename, line, 0,
2269                            "Invalid PreferredLifetime= value, ignoring: %s", rvalue);
2270                 return 0;
2271         }
2272
2273         n->lifetime_preferred_usec = k;
2274         TAKE_PTR(n);
2275
2276         return 0;
2277 }
2278
2279 int config_parse_address_flags(
2280                 const char *unit,
2281                 const char *filename,
2282                 unsigned line,
2283                 const char *section,
2284                 unsigned section_line,
2285                 const char *lvalue,
2286                 int ltype,
2287                 const char *rvalue,
2288                 void *data,
2289                 void *userdata) {
2290
2291         Network *network = userdata;
2292         _cleanup_(address_unref_or_set_invalidp) Address *n = NULL;
2293         int r;
2294
2295         assert(filename);
2296         assert(section);
2297         assert(lvalue);
2298         assert(rvalue);
2299         assert(data);
2300
2301         r = address_new_static(network, filename, section_line, &n);
2302         if (r == -ENOMEM)
2303                 return log_oom();
2304         if (r < 0) {
2305                 log_syntax(unit, LOG_WARNING, filename, line, r,
2306                            "Failed to allocate new address, ignoring assignment: %m");
2307                 return 0;
2308         }
2309
2310         r = parse_boolean(rvalue);
2311         if (r < 0) {
2312                 log_syntax(unit, LOG_WARNING, filename, line, r,
2313                            "Failed to parse %s=, ignoring: %s", lvalue, rvalue);
2314                 return 0;
2315         }
2316
2317         if (streq(lvalue, "AddPrefixRoute"))
2318                 r = !r;
2319
2320         SET_FLAG(n->flags, ltype, r);
2321
2322         TAKE_PTR(n);
2323         return 0;
2324 }
2325
2326 int config_parse_address_scope(
2327                 const char *unit,
2328                 const char *filename,
2329                 unsigned line,
2330                 const char *section,
2331                 unsigned section_line,
2332                 const char *lvalue,
2333                 int ltype,
2334                 const char *rvalue,
2335                 void *data,
2336                 void *userdata) {
2337
2338         Network *network = userdata;
2339         _cleanup_(address_unref_or_set_invalidp) Address *n = NULL;
2340         int r;
2341
2342         assert(filename);
2343         assert(section);
2344         assert(lvalue);
2345         assert(rvalue);
2346         assert(data);
2347
2348         r = address_new_static(network, filename, section_line, &n);
2349         if (r == -ENOMEM)
2350                 return log_oom();
2351         if (r < 0) {
2352                 log_syntax(unit, LOG_WARNING, filename, line, r,
2353                            "Failed to allocate new address, ignoring assignment: %m");
2354                 return 0;
2355         }
2356
2357         r = route_scope_from_string(rvalue);
2358         if (r < 0) {
2359                 log_syntax(unit, LOG_WARNING, filename, line, r,
2360                            "Could not parse address scope \"%s\", ignoring assignment: %m", rvalue);
2361                 return 0;
2362         }
2363
2364         n->scope = r;
2365         n->scope_set = true;
2366         TAKE_PTR(n);
2367         return 0;
2368 }
2369
2370 int config_parse_address_route_metric(
2371                 const char *unit,
2372                 const char *filename,
2373                 unsigned line,
2374                 const char *section,
2375                 unsigned section_line,
2376                 const char *lvalue,
2377                 int ltype,
2378                 const char *rvalue,
2379                 void *data,
2380                 void *userdata) {
2381
2382         Network *network = userdata;
2383         _cleanup_(address_unref_or_set_invalidp) Address *n = NULL;
2384         int r;
2385
2386         assert(filename);
2387         assert(section);
2388         assert(lvalue);
2389         assert(rvalue);
2390         assert(data);
2391
2392         r = address_new_static(network, filename, section_line, &n);
2393         if (r == -ENOMEM)
2394                 return log_oom();
2395         if (r < 0) {
2396                 log_syntax(unit, LOG_WARNING, filename, line, r,
2397                            "Failed to allocate new address, ignoring assignment: %m");
2398                 return 0;
2399         }
2400
2401         r = safe_atou32(rvalue, &n->route_metric);
2402         if (r < 0) {
2403                 log_syntax(unit, LOG_WARNING, filename, line, r,
2404                            "Could not parse %s=, ignoring assignment: %s", lvalue, rvalue);
2405                 return 0;
2406         }
2407
2408         TAKE_PTR(n);
2409         return 0;
2410 }
2411
2412 int config_parse_duplicate_address_detection(
2413                 const char *unit,
2414                 const char *filename,
2415                 unsigned line,
2416                 const char *section,
2417                 unsigned section_line,
2418                 const char *lvalue,
2419                 int ltype,
2420                 const char *rvalue,
2421                 void *data,
2422                 void *userdata) {
2423
2424         Network *network = userdata;
2425         _cleanup_(address_unref_or_set_invalidp) Address *n = NULL;
2426         int r;
2427
2428         assert(filename);
2429         assert(section);
2430         assert(lvalue);
2431         assert(rvalue);
2432         assert(data);
2433
2434         r = address_new_static(network, filename, section_line, &n);
2435         if (r == -ENOMEM)
2436                 return log_oom();
2437         if (r < 0) {
2438                 log_syntax(unit, LOG_WARNING, filename, line, r,
2439                            "Failed to allocate new address, ignoring assignment: %m");
2440                 return 0;
2441         }
2442
2443         r = parse_boolean(rvalue);
2444         if (r >= 0) {
2445                 log_syntax(unit, LOG_WARNING, filename, line, 0,
2446                            "For historical reasons, %s=%s means %s=%s. "
2447                            "Please use 'both', 'ipv4', 'ipv6' or 'none' instead.",
2448                            lvalue, rvalue, lvalue, r ? "none" : "both");
2449                 n->duplicate_address_detection = r ? ADDRESS_FAMILY_NO : ADDRESS_FAMILY_YES;
2450                 n = NULL;
2451                 return 0;
2452         }
2453
2454         AddressFamily a = duplicate_address_detection_address_family_from_string(rvalue);
2455         if (a < 0) {
2456                 log_syntax(unit, LOG_WARNING, filename, line, a,
2457                            "Failed to parse %s=, ignoring: %s", lvalue, rvalue);
2458                 return 0;
2459         }
2460         n->duplicate_address_detection = a;
2461
2462         TAKE_PTR(n);
2463         return 0;
2464 }
2465
2466 int config_parse_address_netlabel(
2467                 const char *unit,
2468                 const char *filename,
2469                 unsigned line,
2470                 const char *section,
2471                 unsigned section_line,
2472                 const char *lvalue,
2473                 int ltype,
2474                 const char *rvalue,
2475                 void *data,
2476                 void *userdata) {
2477
2478         Network *network = userdata;
2479         _cleanup_(address_unref_or_set_invalidp) Address *n = NULL;
2480         int r;
2481
2482         assert(filename);
2483         assert(section);
2484         assert(lvalue);
2485         assert(rvalue);
2486         assert(data);
2487         assert(network);
2488
2489         r = address_new_static(network, filename, section_line, &n);
2490         if (r == -ENOMEM)
2491                 return log_oom();
2492         if (r < 0) {
2493                 log_syntax(unit, LOG_WARNING, filename, line, r,
2494                            "Failed to allocate new address, ignoring assignment: %m");
2495                 return 0;
2496         }
2497
2498         r = config_parse_string(unit, filename, line, section, section_line,
2499                                 lvalue, CONFIG_PARSE_STRING_SAFE, rvalue, &n->netlabel, network);
2500         if (r < 0)
2501                 return r;
2502
2503         TAKE_PTR(n);
2504         return 0;
2505 }
2506
2507 static void address_section_adjust_broadcast(Address *address) {
2508         assert(address);
2509         assert(address->section);
2510
2511         if (!in4_addr_is_set(&address->broadcast))
2512                 return;
2513
2514         if (address->family == AF_INET6)
2515                 log_warning("%s: broadcast address is set for an IPv6 address. "
2516                             "Ignoring Broadcast= setting in the [Address] section from line %u.",
2517                             address->section->filename, address->section->line);
2518         else if (address->prefixlen > 30)
2519                 log_warning("%s: broadcast address is set for an IPv4 address with prefix length larger than 30. "
2520                             "Ignoring Broadcast= setting in the [Address] section from line %u.",
2521                             address->section->filename, address->section->line);
2522         else if (in4_addr_is_set(&address->in_addr_peer.in))
2523                 log_warning("%s: broadcast address is set for an IPv4 address with peer address. "
2524                             "Ignoring Broadcast= setting in the [Address] section from line %u.",
2525                             address->section->filename, address->section->line);
2526         else if (!in4_addr_is_set(&address->in_addr.in))
2527                 log_warning("%s: broadcast address is set for an IPv4 address with null address. "
2528                             "Ignoring Broadcast= setting in the [Address] section from line %u.",
2529                             address->section->filename, address->section->line);
2530         else
2531                 /* Otherwise, keep the specified broadcast address. */
2532                 return;
2533
2534         address->broadcast.s_addr = 0;
2535 }
2536
2537 int address_section_verify(Address *address) {
2538         if (section_is_invalid(address->section))
2539                 return -EINVAL;
2540
2541         if (address->family == AF_UNSPEC) {
2542                 assert(address->section);
2543
2544                 return log_warning_errno(SYNTHETIC_ERRNO(EINVAL),
2545                                          "%s: Address section without Address= field was configured. "
2546                                          "Ignoring [Address] section from line %u.",
2547                                          address->section->filename, address->section->line);
2548         }
2549
2550         if (address->family == AF_INET6 && !socket_ipv6_is_supported())
2551                 return log_warning_errno(SYNTHETIC_ERRNO(EINVAL),
2552                                          "%s: an IPv6 address was configured, but the kernel does not support IPv6. "
2553                                          "Ignoring [Address] section from line %u.",
2554                                          address->section->filename, address->section->line);
2555
2556         assert(IN_SET(address->family, AF_INET, AF_INET6));
2557
2558         address_section_adjust_broadcast(address);
2559
2560         if (address->family == AF_INET6 && address->label) {
2561                 log_warning("%s: address label is set for IPv6 address in the [Address] section from line %u. "
2562                             "Ignoring Label= setting.",
2563                             address->section->filename, address->section->line);
2564
2565                 address->label = mfree(address->label);
2566         }
2567
2568         if (!address->scope_set) {
2569                 if (in_addr_is_localhost(address->family, &address->in_addr) > 0)
2570                         address->scope = RT_SCOPE_HOST;
2571                 else if (in_addr_is_link_local(address->family, &address->in_addr) > 0)
2572                         address->scope = RT_SCOPE_LINK;
2573         }
2574
2575         if (address->duplicate_address_detection < 0) {
2576                 if (address->family == AF_INET6)
2577                         address->duplicate_address_detection = ADDRESS_FAMILY_IPV6;
2578                 else if (in4_addr_is_link_local(&address->in_addr.in))
2579                         address->duplicate_address_detection = ADDRESS_FAMILY_IPV4;
2580                 else
2581                         address->duplicate_address_detection = ADDRESS_FAMILY_NO;
2582         } else if (address->duplicate_address_detection == ADDRESS_FAMILY_IPV6 && address->family == AF_INET)
2583                 log_warning("%s: DuplicateAddressDetection=ipv6 is specified for IPv4 address, ignoring.",
2584                             address->section->filename);
2585         else if (address->duplicate_address_detection == ADDRESS_FAMILY_IPV4 && address->family == AF_INET6)
2586                 log_warning("%s: DuplicateAddressDetection=ipv4 is specified for IPv6 address, ignoring.",
2587                             address->section->filename);
2588
2589         if (address->family == AF_INET6 &&
2590             !FLAGS_SET(address->duplicate_address_detection, ADDRESS_FAMILY_IPV6))
2591                 address->flags |= IFA_F_NODAD;
2592
2593         uint32_t filtered_flags = address->family == AF_INET ?
2594                 address->flags & KNOWN_FLAGS & ~UNMANAGED_FLAGS & ~IPV6ONLY_FLAGS :
2595                 address->flags & KNOWN_FLAGS & ~UNMANAGED_FLAGS;
2596         if (address->flags != filtered_flags) {
2597                 _cleanup_free_ char *str = NULL;
2598
2599                 (void) address_flags_to_string_alloc(address->flags ^ filtered_flags, address->family, &str);
2600                 return log_warning_errno(SYNTHETIC_ERRNO(EINVAL),
2601                                          "%s: unexpected address flags \"%s\" were configured. "
2602                                          "Ignoring [Address] section from line %u.",
2603                                          address->section->filename, strna(str), address->section->line);
2604         }
2605
2606         return 0;
2607 }
2608
2609 int network_drop_invalid_addresses(Network *network) {
2610         _cleanup_set_free_ Set *addresses = NULL;
2611         Address *address;
2612         int r;
2613
2614         assert(network);
2615
2616         ORDERED_HASHMAP_FOREACH(address, network->addresses_by_section) {
2617                 Address *dup;
2618
2619                 if (address_section_verify(address) < 0) {
2620                         /* Drop invalid [Address] sections or Address= settings in [Network].
2621                          * Note that address_detach() will drop the address from addresses_by_section. */
2622                         address_detach(address);
2623                         continue;
2624                 }
2625
2626                 /* Always use the setting specified later. So, remove the previously assigned setting. */
2627                 dup = set_remove(addresses, address);
2628                 if (dup) {
2629                         log_warning("%s: Duplicated address %s is specified at line %u and %u, "
2630                                     "dropping the address setting specified at line %u.",
2631                                     dup->section->filename,
2632                                     IN_ADDR_PREFIX_TO_STRING(address->family, &address->in_addr, address->prefixlen),
2633                                     address->section->line,
2634                                     dup->section->line, dup->section->line);
2635
2636                         /* address_detach() will drop the address from addresses_by_section. */
2637                         address_detach(dup);
2638                 }
2639
2640                 /* Use address_hash_ops, instead of address_hash_ops_detach. Otherwise, the Address objects
2641                  * will be detached. */
2642                 r = set_ensure_put(&addresses, &address_hash_ops, address);
2643                 if (r < 0)
2644                         return log_oom();
2645                 assert(r > 0);
2646         }
2647
2648         r = network_adjust_dhcp_server(network, &addresses);
2649         if (r < 0)
2650                 return r;
2651
2652         return 0;
2653 }
2654
2655 int config_parse_address_ip_nft_set(
2656                 const char *unit,
2657                 const char *filename,
2658                 unsigned line,
2659                 const char *section,
2660                 unsigned section_line,
2661                 const char *lvalue,
2662                 int ltype,
2663                 const char *rvalue,
2664                 void *data,
2665                 void *userdata) {
2666
2667         Network *network = userdata;
2668         _cleanup_(address_unref_or_set_invalidp) Address *n = NULL;
2669         int r;
2670
2671         assert(filename);
2672         assert(lvalue);
2673         assert(rvalue);
2674         assert(network);
2675
2676         r = address_new_static(network, filename, section_line, &n);
2677         if (r == -ENOMEM)
2678                 return log_oom();
2679         if (r < 0) {
2680                 log_syntax(unit, LOG_WARNING, filename, line, r,
2681                            "Failed to allocate a new address, ignoring assignment: %m");
2682                 return 0;
2683         }
2684
2685         r = config_parse_nft_set(unit, filename, line, section, section_line, lvalue, ltype, rvalue, &n->nft_set_context, network);
2686         if (r < 0)
2687                 return r;
2688
2689         TAKE_PTR(n);
2690         return 0;
2691 }