src/nspawn/nspawn-network.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <linux/veth.h>
   4 #include <net/if.h>
   5 #include <sys/file.h>
   6
   7 #include "sd-device.h"
   8 #include "sd-id128.h"
   9 #include "sd-netlink.h"
  10
  11 #include "alloc-util.h"
  12 #include "ether-addr-util.h"
  13 #include "lockfile-util.h"
  14 #include "netlink-util.h"
  15 #include "nspawn-network.h"
  16 #include "siphash24.h"
  17 #include "socket-util.h"
  18 #include "stat-util.h"
  19 #include "string-util.h"
  20 #include "strv.h"
  21 #include "util.h"
  22
  23 #define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
  24 #define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
  25 #define VETH_EXTRA_HOST_HASH_KEY SD_ID128_MAKE(48,c7,f6,b7,ea,9d,4c,9e,b7,28,d4,de,91,d5,bf,66)
  26 #define VETH_EXTRA_CONTAINER_HASH_KEY SD_ID128_MAKE(af,50,17,61,ce,f9,4d,35,84,0d,2b,20,54,be,ce,59)
  27 #define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)
  28
  29 static int remove_one_link(sd_netlink *rtnl, const char *name) {
  30         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
  31         int r;
  32
  33         if (isempty(name))
  34                 return 0;
  35
  36         r = sd_rtnl_message_new_link(rtnl, &m, RTM_DELLINK, 0);
  37         if (r < 0)
  38                 return log_error_errno(r, "Failed to allocate netlink message: %m");
  39
  40         r = sd_netlink_message_append_string(m, IFLA_IFNAME, name);
  41         if (r < 0)
  42                 return log_error_errno(r, "Failed to add netlink interface name: %m");
  43
  44         r = sd_netlink_call(rtnl, m, 0, NULL);
  45         if (r == -ENODEV) /* Already gone */
  46                 return 0;
  47         if (r < 0)
  48                 return log_error_errno(r, "Failed to remove interface %s: %m", name);
  49
  50         return 1;
  51 }
  52
  53 static int generate_mac(
  54                 const char *machine_name,
  55                 struct ether_addr *mac,
  56                 sd_id128_t hash_key,
  57                 uint64_t idx) {
  58
  59         uint64_t result;
  60         size_t l, sz;
  61         uint8_t *v, *i;
  62         int r;
  63
  64         l = strlen(machine_name);
  65         sz = sizeof(sd_id128_t) + l;
  66         if (idx > 0)
  67                 sz += sizeof(idx);
  68
  69         v = alloca(sz);
  70
  71         /* fetch some persistent data unique to the host */
  72         r = sd_id128_get_machine((sd_id128_t*) v);
  73         if (r < 0)
  74                 return r;
  75
  76         /* combine with some data unique (on this host) to this
  77          * container instance */
  78         i = mempcpy(v + sizeof(sd_id128_t), machine_name, l);
  79         if (idx > 0) {
  80                 idx = htole64(idx);
  81                 memcpy(i, &idx, sizeof(idx));
  82         }
  83
  84         /* Let's hash the host machine ID plus the container name. We
  85          * use a fixed, but originally randomly created hash key here. */
  86         result = htole64(siphash24(v, sz, hash_key.bytes));
  87
  88         assert_cc(ETH_ALEN <= sizeof(result));
  89         memcpy(mac->ether_addr_octet, &result, ETH_ALEN);
  90
  91         /* see eth_random_addr in the kernel */
  92         mac->ether_addr_octet[0] &= 0xfe;        /* clear multicast bit */
  93         mac->ether_addr_octet[0] |= 0x02;        /* set local assignment bit (IEEE802) */
  94
  95         return 0;
  96 }
  97
  98 static int add_veth(
  99                 sd_netlink *rtnl,
 100                 pid_t pid,
 101                 const char *ifname_host,
 102                 const struct ether_addr *mac_host,
 103                 const char *ifname_container,
 104                 const struct ether_addr *mac_container) {
 105
 106         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 107         int r;
 108
 109         assert(rtnl);
 110         assert(ifname_host);
 111         assert(mac_host);
 112         assert(ifname_container);
 113         assert(mac_container);
 114
 115         r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 116         if (r < 0)
 117                 return log_error_errno(r, "Failed to allocate netlink message: %m");
 118
 119         r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_host);
 120         if (r < 0)
 121                 return log_error_errno(r, "Failed to add netlink interface name: %m");
 122
 123         r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_host);
 124         if (r < 0)
 125                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
 126
 127         r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 128         if (r < 0)
 129                 return log_error_errno(r, "Failed to open netlink container: %m");
 130
 131         r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "veth");
 132         if (r < 0)
 133                 return log_error_errno(r, "Failed to open netlink container: %m");
 134
 135         r = sd_netlink_message_open_container(m, VETH_INFO_PEER);
 136         if (r < 0)
 137                 return log_error_errno(r, "Failed to open netlink container: %m");
 138
 139         r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_container);
 140         if (r < 0)
 141                 return log_error_errno(r, "Failed to add netlink interface name: %m");
 142
 143         r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_container);
 144         if (r < 0)
 145                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
 146
 147         r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 148         if (r < 0)
 149                 return log_error_errno(r, "Failed to add netlink namespace field: %m");
 150
 151         r = sd_netlink_message_close_container(m);
 152         if (r < 0)
 153                 return log_error_errno(r, "Failed to close netlink container: %m");
 154
 155         r = sd_netlink_message_close_container(m);
 156         if (r < 0)
 157                 return log_error_errno(r, "Failed to close netlink container: %m");
 158
 159         r = sd_netlink_message_close_container(m);
 160         if (r < 0)
 161                 return log_error_errno(r, "Failed to close netlink container: %m");
 162
 163         r = sd_netlink_call(rtnl, m, 0, NULL);
 164         if (r < 0)
 165                 return log_error_errno(r, "Failed to add new veth interfaces (%s:%s): %m", ifname_host, ifname_container);
 166
 167         return 0;
 168 }
 169
 170 int setup_veth(const char *machine_name,
 171                pid_t pid,
 172                char iface_name[IFNAMSIZ],
 173                bool bridge) {
 174
 175         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 176         struct ether_addr mac_host, mac_container;
 177         int r, i;
 178
 179         assert(machine_name);
 180         assert(pid > 0);
 181         assert(iface_name);
 182
 183         /* Use two different interface name prefixes depending whether
 184          * we are in bridge mode or not. */
 185         snprintf(iface_name, IFNAMSIZ - 1, "%s-%s",
 186                  bridge ? "vb" : "ve", machine_name);
 187
 188         r = generate_mac(machine_name, &mac_container, CONTAINER_HASH_KEY, 0);
 189         if (r < 0)
 190                 return log_error_errno(r, "Failed to generate predictable MAC address for container side: %m");
 191
 192         r = generate_mac(machine_name, &mac_host, HOST_HASH_KEY, 0);
 193         if (r < 0)
 194                 return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");
 195
 196         r = sd_netlink_open(&rtnl);
 197         if (r < 0)
 198                 return log_error_errno(r, "Failed to connect to netlink: %m");
 199
 200         r = add_veth(rtnl, pid, iface_name, &mac_host, "host0", &mac_container);
 201         if (r < 0)
 202                 return r;
 203
 204         i = (int) if_nametoindex(iface_name);
 205         if (i <= 0)
 206                 return log_error_errno(errno, "Failed to resolve interface %s: %m", iface_name);
 207
 208         return i;
 209 }
 210
 211 int setup_veth_extra(
 212                 const char *machine_name,
 213                 pid_t pid,
 214                 char **pairs) {
 215
 216         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 217         uint64_t idx = 0;
 218         char **a, **b;
 219         int r;
 220
 221         assert(machine_name);
 222         assert(pid > 0);
 223
 224         if (strv_isempty(pairs))
 225                 return 0;
 226
 227         r = sd_netlink_open(&rtnl);
 228         if (r < 0)
 229                 return log_error_errno(r, "Failed to connect to netlink: %m");
 230
 231         STRV_FOREACH_PAIR(a, b, pairs) {
 232                 struct ether_addr mac_host, mac_container;
 233
 234                 r = generate_mac(machine_name, &mac_container, VETH_EXTRA_CONTAINER_HASH_KEY, idx);
 235                 if (r < 0)
 236                         return log_error_errno(r, "Failed to generate predictable MAC address for container side of extra veth link: %m");
 237
 238                 r = generate_mac(machine_name, &mac_host, VETH_EXTRA_HOST_HASH_KEY, idx);
 239                 if (r < 0)
 240                         return log_error_errno(r, "Failed to generate predictable MAC address for container side of extra veth link: %m");
 241
 242                 r = add_veth(rtnl, pid, *a, &mac_host, *b, &mac_container);
 243                 if (r < 0)
 244                         return r;
 245
 246                 idx++;
 247         }
 248
 249         return 0;
 250 }
 251
 252 static int join_bridge(sd_netlink *rtnl, const char *veth_name, const char *bridge_name) {
 253         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 254         int r, bridge_ifi;
 255
 256         assert(rtnl);
 257         assert(veth_name);
 258         assert(bridge_name);
 259
 260         bridge_ifi = (int) if_nametoindex(bridge_name);
 261         if (bridge_ifi <= 0)
 262                 return -errno;
 263
 264         r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
 265         if (r < 0)
 266                 return r;
 267
 268         r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
 269         if (r < 0)
 270                 return r;
 271
 272         r = sd_netlink_message_append_string(m, IFLA_IFNAME, veth_name);
 273         if (r < 0)
 274                 return r;
 275
 276         r = sd_netlink_message_append_u32(m, IFLA_MASTER, bridge_ifi);
 277         if (r < 0)
 278                 return r;
 279
 280         r = sd_netlink_call(rtnl, m, 0, NULL);
 281         if (r < 0)
 282                 return r;
 283
 284         return bridge_ifi;
 285 }
 286
 287 static int create_bridge(sd_netlink *rtnl, const char *bridge_name) {
 288         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 289         int r;
 290
 291         r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 292         if (r < 0)
 293                 return r;
 294
 295         r = sd_netlink_message_append_string(m, IFLA_IFNAME, bridge_name);
 296         if (r < 0)
 297                 return r;
 298
 299         r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 300         if (r < 0)
 301                 return r;
 302
 303         r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "bridge");
 304         if (r < 0)
 305                 return r;
 306
 307         r = sd_netlink_message_close_container(m);
 308         if (r < 0)
 309                 return r;
 310
 311         r = sd_netlink_message_close_container(m);
 312         if (r < 0)
 313                 return r;
 314
 315         r = sd_netlink_call(rtnl, m, 0, NULL);
 316         if (r < 0)
 317                 return r;
 318
 319         return 0;
 320 }
 321
 322 int setup_bridge(const char *veth_name, const char *bridge_name, bool create) {
 323         _cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
 324         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 325         int r, bridge_ifi;
 326         unsigned n = 0;
 327
 328         assert(veth_name);
 329         assert(bridge_name);
 330
 331         r = sd_netlink_open(&rtnl);
 332         if (r < 0)
 333                 return log_error_errno(r, "Failed to connect to netlink: %m");
 334
 335         if (create) {
 336                 /* We take a system-wide lock here, so that we can safely check whether there's still a member in the
 337                  * bridge before removing it, without risking interference from other nspawn instances. */
 338
 339                 r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
 340                 if (r < 0)
 341                         return log_error_errno(r, "Failed to take network zone lock: %m");
 342         }
 343
 344         for (;;) {
 345                 bridge_ifi = join_bridge(rtnl, veth_name, bridge_name);
 346                 if (bridge_ifi >= 0)
 347                         return bridge_ifi;
 348                 if (bridge_ifi != -ENODEV || !create || n > 10)
 349                         return log_error_errno(bridge_ifi, "Failed to add interface %s to bridge %s: %m", veth_name, bridge_name);
 350
 351                 /* Count attempts, so that we don't enter an endless loop here. */
 352                 n++;
 353
 354                 /* The bridge doesn't exist yet. Let's create it */
 355                 r = create_bridge(rtnl, bridge_name);
 356                 if (r < 0)
 357                         return log_error_errno(r, "Failed to create bridge interface %s: %m", bridge_name);
 358
 359                 /* Try again, now that the bridge exists */
 360         }
 361 }
 362
 363 int remove_bridge(const char *bridge_name) {
 364         _cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
 365         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 366         const char *path;
 367         int r;
 368
 369         /* Removes the specified bridge, but only if it is currently empty */
 370
 371         if (isempty(bridge_name))
 372                 return 0;
 373
 374         r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
 375         if (r < 0)
 376                 return log_error_errno(r, "Failed to take network zone lock: %m");
 377
 378         path = strjoina("/sys/class/net/", bridge_name, "/brif");
 379
 380         r = dir_is_empty(path);
 381         if (r == -ENOENT) /* Already gone? */
 382                 return 0;
 383         if (r < 0)
 384                 return log_error_errno(r, "Can't detect if bridge %s is empty: %m", bridge_name);
 385         if (r == 0) /* Still populated, leave it around */
 386                 return 0;
 387
 388         r = sd_netlink_open(&rtnl);
 389         if (r < 0)
 390                 return log_error_errno(r, "Failed to connect to netlink: %m");
 391
 392         return remove_one_link(rtnl, bridge_name);
 393 }
 394
 395 static int parse_interface(const char *name) {
 396         _cleanup_(sd_device_unrefp) sd_device *d = NULL;
 397         char ifi_str[2 + DECIMAL_STR_MAX(int)];
 398         int ifi, r;
 399
 400         ifi = (int) if_nametoindex(name);
 401         if (ifi <= 0)
 402                 return log_error_errno(errno, "Failed to resolve interface %s: %m", name);
 403
 404         sprintf(ifi_str, "n%i", ifi);
 405         r = sd_device_new_from_device_id(&d, ifi_str);
 406         if (r < 0)
 407                 return log_error_errno(r, "Failed to get device for interface %s: %m", name);
 408
 409         r = sd_device_get_is_initialized(d);
 410         if (r < 0)
 411                 return log_error_errno(r, "Failed to determine whether interface %s is initialized or not: %m", name);
 412         if (r == 0) {
 413                 log_error("Network interface %s is not initialized yet.", name);
 414                 return -EBUSY;
 415         }
 416
 417         return ifi;
 418 }
 419
 420 int move_network_interfaces(pid_t pid, char **ifaces) {
 421         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 422         char **i;
 423         int r;
 424
 425         if (strv_isempty(ifaces))
 426                 return 0;
 427
 428         r = sd_netlink_open(&rtnl);
 429         if (r < 0)
 430                 return log_error_errno(r, "Failed to connect to netlink: %m");
 431
 432         STRV_FOREACH(i, ifaces) {
 433                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 434                 int ifi;
 435
 436                 ifi = parse_interface(*i);
 437                 if (ifi < 0)
 438                         return ifi;
 439
 440                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
 441                 if (r < 0)
 442                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 443
 444                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 445                 if (r < 0)
 446                         return log_error_errno(r, "Failed to append namespace PID to netlink message: %m");
 447
 448                 r = sd_netlink_call(rtnl, m, 0, NULL);
 449                 if (r < 0)
 450                         return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
 451         }
 452
 453         return 0;
 454 }
 455
 456 int setup_macvlan(const char *machine_name, pid_t pid, char **ifaces) {
 457         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 458         unsigned idx = 0;
 459         char **i;
 460         int r;
 461
 462         if (strv_isempty(ifaces))
 463                 return 0;
 464
 465         r = sd_netlink_open(&rtnl);
 466         if (r < 0)
 467                 return log_error_errno(r, "Failed to connect to netlink: %m");
 468
 469         STRV_FOREACH(i, ifaces) {
 470                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 471                 _cleanup_free_ char *n = NULL;
 472                 struct ether_addr mac;
 473                 int ifi;
 474
 475                 ifi = parse_interface(*i);
 476                 if (ifi < 0)
 477                         return ifi;
 478
 479                 r = generate_mac(machine_name, &mac, MACVLAN_HASH_KEY, idx++);
 480                 if (r < 0)
 481                         return log_error_errno(r, "Failed to create MACVLAN MAC address: %m");
 482
 483                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 484                 if (r < 0)
 485                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 486
 487                 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
 488                 if (r < 0)
 489                         return log_error_errno(r, "Failed to add netlink interface index: %m");
 490
 491                 n = strappend("mv-", *i);
 492                 if (!n)
 493                         return log_oom();
 494
 495                 strshorten(n, IFNAMSIZ-1);
 496
 497                 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
 498                 if (r < 0)
 499                         return log_error_errno(r, "Failed to add netlink interface name: %m");
 500
 501                 r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
 502                 if (r < 0)
 503                         return log_error_errno(r, "Failed to add netlink MAC address: %m");
 504
 505                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 506                 if (r < 0)
 507                         return log_error_errno(r, "Failed to add netlink namespace field: %m");
 508
 509                 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 510                 if (r < 0)
 511                         return log_error_errno(r, "Failed to open netlink container: %m");
 512
 513                 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
 514                 if (r < 0)
 515                         return log_error_errno(r, "Failed to open netlink container: %m");
 516
 517                 r = sd_netlink_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
 518                 if (r < 0)
 519                         return log_error_errno(r, "Failed to append macvlan mode: %m");
 520
 521                 r = sd_netlink_message_close_container(m);
 522                 if (r < 0)
 523                         return log_error_errno(r, "Failed to close netlink container: %m");
 524
 525                 r = sd_netlink_message_close_container(m);
 526                 if (r < 0)
 527                         return log_error_errno(r, "Failed to close netlink container: %m");
 528
 529                 r = sd_netlink_call(rtnl, m, 0, NULL);
 530                 if (r < 0)
 531                         return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
 532         }
 533
 534         return 0;
 535 }
 536
 537 int setup_ipvlan(const char *machine_name, pid_t pid, char **ifaces) {
 538         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 539         char **i;
 540         int r;
 541
 542         if (strv_isempty(ifaces))
 543                 return 0;
 544
 545         r = sd_netlink_open(&rtnl);
 546         if (r < 0)
 547                 return log_error_errno(r, "Failed to connect to netlink: %m");
 548
 549         STRV_FOREACH(i, ifaces) {
 550                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 551                 _cleanup_free_ char *n = NULL;
 552                 int ifi;
 553
 554                 ifi = parse_interface(*i);
 555                 if (ifi < 0)
 556                         return ifi;
 557
 558                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 559                 if (r < 0)
 560                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 561
 562                 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
 563                 if (r < 0)
 564                         return log_error_errno(r, "Failed to add netlink interface index: %m");
 565
 566                 n = strappend("iv-", *i);
 567                 if (!n)
 568                         return log_oom();
 569
 570                 strshorten(n, IFNAMSIZ-1);
 571
 572                 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
 573                 if (r < 0)
 574                         return log_error_errno(r, "Failed to add netlink interface name: %m");
 575
 576                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 577                 if (r < 0)
 578                         return log_error_errno(r, "Failed to add netlink namespace field: %m");
 579
 580                 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 581                 if (r < 0)
 582                         return log_error_errno(r, "Failed to open netlink container: %m");
 583
 584                 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "ipvlan");
 585                 if (r < 0)
 586                         return log_error_errno(r, "Failed to open netlink container: %m");
 587
 588                 r = sd_netlink_message_append_u16(m, IFLA_IPVLAN_MODE, IPVLAN_MODE_L2);
 589                 if (r < 0)
 590                         return log_error_errno(r, "Failed to add ipvlan mode: %m");
 591
 592                 r = sd_netlink_message_close_container(m);
 593                 if (r < 0)
 594                         return log_error_errno(r, "Failed to close netlink container: %m");
 595
 596                 r = sd_netlink_message_close_container(m);
 597                 if (r < 0)
 598                         return log_error_errno(r, "Failed to close netlink container: %m");
 599
 600                 r = sd_netlink_call(rtnl, m, 0, NULL);
 601                 if (r < 0)
 602                         return log_error_errno(r, "Failed to add new ipvlan interfaces: %m");
 603         }
 604
 605         return 0;
 606 }
 607
 608 int veth_extra_parse(char ***l, const char *p) {
 609         _cleanup_free_ char *a = NULL, *b = NULL;
 610         int r;
 611
 612         r = extract_first_word(&p, &a, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 613         if (r < 0)
 614                 return r;
 615         if (r == 0 || !ifname_valid(a))
 616                 return -EINVAL;
 617
 618         r = extract_first_word(&p, &b, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 619         if (r < 0)
 620                 return r;
 621         if (r == 0 || !ifname_valid(b)) {
 622                 free(b);
 623                 b = strdup(a);
 624                 if (!b)
 625                         return -ENOMEM;
 626         }
 627
 628         if (p)
 629                 return -EINVAL;
 630
 631         r = strv_push_pair(l, a, b);
 632         if (r < 0)
 633                 return -ENOMEM;
 634
 635         a = b = NULL;
 636         return 0;
 637 }
 638
 639 int remove_veth_links(const char *primary, char **pairs) {
 640         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 641         char **a, **b;
 642         int r;
 643
 644         /* In some cases the kernel might pin the veth links between host and container even after the namespace
 645          * died. Hence, let's better remove them explicitly too. */
 646
 647         if (isempty(primary) && strv_isempty(pairs))
 648                 return 0;
 649
 650         r = sd_netlink_open(&rtnl);
 651         if (r < 0)
 652                 return log_error_errno(r, "Failed to connect to netlink: %m");
 653
 654         remove_one_link(rtnl, primary);
 655
 656         STRV_FOREACH_PAIR(a, b, pairs)
 657                 remove_one_link(rtnl, *a);
 658
 659         return 0;
 660 }