src/nspawn/nspawn-network.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <linux/veth.h>
   4 #include <net/if.h>
   5 #include <sys/file.h>
   6
   7 #include "sd-device.h"
   8 #include "sd-id128.h"
   9 #include "sd-netlink.h"
  10
  11 #include "alloc-util.h"
  12 #include "ether-addr-util.h"
  13 #include "lockfile-util.h"
  14 #include "missing_network.h"
  15 #include "netlink-util.h"
  16 #include "nspawn-network.h"
  17 #include "siphash24.h"
  18 #include "socket-util.h"
  19 #include "stat-util.h"
  20 #include "string-util.h"
  21 #include "strv.h"
  22 #include "util.h"
  23
  24 #define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
  25 #define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
  26 #define VETH_EXTRA_HOST_HASH_KEY SD_ID128_MAKE(48,c7,f6,b7,ea,9d,4c,9e,b7,28,d4,de,91,d5,bf,66)
  27 #define VETH_EXTRA_CONTAINER_HASH_KEY SD_ID128_MAKE(af,50,17,61,ce,f9,4d,35,84,0d,2b,20,54,be,ce,59)
  28 #define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)
  29
  30 static int remove_one_link(sd_netlink *rtnl, const char *name) {
  31         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
  32         int r;
  33
  34         if (isempty(name))
  35                 return 0;
  36
  37         r = sd_rtnl_message_new_link(rtnl, &m, RTM_DELLINK, 0);
  38         if (r < 0)
  39                 return log_error_errno(r, "Failed to allocate netlink message: %m");
  40
  41         r = sd_netlink_message_append_string(m, IFLA_IFNAME, name);
  42         if (r < 0)
  43                 return log_error_errno(r, "Failed to add netlink interface name: %m");
  44
  45         r = sd_netlink_call(rtnl, m, 0, NULL);
  46         if (r == -ENODEV) /* Already gone */
  47                 return 0;
  48         if (r < 0)
  49                 return log_error_errno(r, "Failed to remove interface %s: %m", name);
  50
  51         return 1;
  52 }
  53
  54 static int generate_mac(
  55                 const char *machine_name,
  56                 struct ether_addr *mac,
  57                 sd_id128_t hash_key,
  58                 uint64_t idx) {
  59
  60         uint64_t result;
  61         size_t l, sz;
  62         uint8_t *v, *i;
  63         int r;
  64
  65         l = strlen(machine_name);
  66         sz = sizeof(sd_id128_t) + l;
  67         if (idx > 0)
  68                 sz += sizeof(idx);
  69
  70         v = newa(uint8_t, sz);
  71
  72         /* fetch some persistent data unique to the host */
  73         r = sd_id128_get_machine((sd_id128_t*) v);
  74         if (r < 0)
  75                 return r;
  76
  77         /* combine with some data unique (on this host) to this
  78          * container instance */
  79         i = mempcpy(v + sizeof(sd_id128_t), machine_name, l);
  80         if (idx > 0) {
  81                 idx = htole64(idx);
  82                 memcpy(i, &idx, sizeof(idx));
  83         }
  84
  85         /* Let's hash the host machine ID plus the container name. We
  86          * use a fixed, but originally randomly created hash key here. */
  87         result = htole64(siphash24(v, sz, hash_key.bytes));
  88
  89         assert_cc(ETH_ALEN <= sizeof(result));
  90         memcpy(mac->ether_addr_octet, &result, ETH_ALEN);
  91
  92         /* see eth_random_addr in the kernel */
  93         mac->ether_addr_octet[0] &= 0xfe;        /* clear multicast bit */
  94         mac->ether_addr_octet[0] |= 0x02;        /* set local assignment bit (IEEE802) */
  95
  96         return 0;
  97 }
  98
  99 static int add_veth(
 100                 sd_netlink *rtnl,
 101                 pid_t pid,
 102                 const char *ifname_host,
 103                 const struct ether_addr *mac_host,
 104                 const char *ifname_container,
 105                 const struct ether_addr *mac_container) {
 106
 107         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 108         int r;
 109
 110         assert(rtnl);
 111         assert(ifname_host);
 112         assert(mac_host);
 113         assert(ifname_container);
 114         assert(mac_container);
 115
 116         r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 117         if (r < 0)
 118                 return log_error_errno(r, "Failed to allocate netlink message: %m");
 119
 120         r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_host);
 121         if (r < 0)
 122                 return log_error_errno(r, "Failed to add netlink interface name: %m");
 123
 124         r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_host);
 125         if (r < 0)
 126                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
 127
 128         r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 129         if (r < 0)
 130                 return log_error_errno(r, "Failed to open netlink container: %m");
 131
 132         r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "veth");
 133         if (r < 0)
 134                 return log_error_errno(r, "Failed to open netlink container: %m");
 135
 136         r = sd_netlink_message_open_container(m, VETH_INFO_PEER);
 137         if (r < 0)
 138                 return log_error_errno(r, "Failed to open netlink container: %m");
 139
 140         r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_container);
 141         if (r < 0)
 142                 return log_error_errno(r, "Failed to add netlink interface name: %m");
 143
 144         r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_container);
 145         if (r < 0)
 146                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
 147
 148         r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 149         if (r < 0)
 150                 return log_error_errno(r, "Failed to add netlink namespace field: %m");
 151
 152         r = sd_netlink_message_close_container(m);
 153         if (r < 0)
 154                 return log_error_errno(r, "Failed to close netlink container: %m");
 155
 156         r = sd_netlink_message_close_container(m);
 157         if (r < 0)
 158                 return log_error_errno(r, "Failed to close netlink container: %m");
 159
 160         r = sd_netlink_message_close_container(m);
 161         if (r < 0)
 162                 return log_error_errno(r, "Failed to close netlink container: %m");
 163
 164         r = sd_netlink_call(rtnl, m, 0, NULL);
 165         if (r < 0)
 166                 return log_error_errno(r, "Failed to add new veth interfaces (%s:%s): %m", ifname_host, ifname_container);
 167
 168         return 0;
 169 }
 170
 171 int setup_veth(const char *machine_name,
 172                pid_t pid,
 173                char iface_name[IFNAMSIZ],
 174                bool bridge) {
 175
 176         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 177         struct ether_addr mac_host, mac_container;
 178         int r, i;
 179
 180         assert(machine_name);
 181         assert(pid > 0);
 182         assert(iface_name);
 183
 184         /* Use two different interface name prefixes depending whether
 185          * we are in bridge mode or not. */
 186         snprintf(iface_name, IFNAMSIZ - 1, "%s-%s",
 187                  bridge ? "vb" : "ve", machine_name);
 188
 189         r = generate_mac(machine_name, &mac_container, CONTAINER_HASH_KEY, 0);
 190         if (r < 0)
 191                 return log_error_errno(r, "Failed to generate predictable MAC address for container side: %m");
 192
 193         r = generate_mac(machine_name, &mac_host, HOST_HASH_KEY, 0);
 194         if (r < 0)
 195                 return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");
 196
 197         r = sd_netlink_open(&rtnl);
 198         if (r < 0)
 199                 return log_error_errno(r, "Failed to connect to netlink: %m");
 200
 201         r = add_veth(rtnl, pid, iface_name, &mac_host, "host0", &mac_container);
 202         if (r < 0)
 203                 return r;
 204
 205         i = (int) if_nametoindex(iface_name);
 206         if (i <= 0)
 207                 return log_error_errno(errno, "Failed to resolve interface %s: %m", iface_name);
 208
 209         return i;
 210 }
 211
 212 int setup_veth_extra(
 213                 const char *machine_name,
 214                 pid_t pid,
 215                 char **pairs) {
 216
 217         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 218         uint64_t idx = 0;
 219         char **a, **b;
 220         int r;
 221
 222         assert(machine_name);
 223         assert(pid > 0);
 224
 225         if (strv_isempty(pairs))
 226                 return 0;
 227
 228         r = sd_netlink_open(&rtnl);
 229         if (r < 0)
 230                 return log_error_errno(r, "Failed to connect to netlink: %m");
 231
 232         STRV_FOREACH_PAIR(a, b, pairs) {
 233                 struct ether_addr mac_host, mac_container;
 234
 235                 r = generate_mac(machine_name, &mac_container, VETH_EXTRA_CONTAINER_HASH_KEY, idx);
 236                 if (r < 0)
 237                         return log_error_errno(r, "Failed to generate predictable MAC address for container side of extra veth link: %m");
 238
 239                 r = generate_mac(machine_name, &mac_host, VETH_EXTRA_HOST_HASH_KEY, idx);
 240                 if (r < 0)
 241                         return log_error_errno(r, "Failed to generate predictable MAC address for container side of extra veth link: %m");
 242
 243                 r = add_veth(rtnl, pid, *a, &mac_host, *b, &mac_container);
 244                 if (r < 0)
 245                         return r;
 246
 247                 idx++;
 248         }
 249
 250         return 0;
 251 }
 252
 253 static int join_bridge(sd_netlink *rtnl, const char *veth_name, const char *bridge_name) {
 254         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 255         int r, bridge_ifi;
 256
 257         assert(rtnl);
 258         assert(veth_name);
 259         assert(bridge_name);
 260
 261         bridge_ifi = (int) if_nametoindex(bridge_name);
 262         if (bridge_ifi <= 0)
 263                 return -errno;
 264
 265         r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
 266         if (r < 0)
 267                 return r;
 268
 269         r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
 270         if (r < 0)
 271                 return r;
 272
 273         r = sd_netlink_message_append_string(m, IFLA_IFNAME, veth_name);
 274         if (r < 0)
 275                 return r;
 276
 277         r = sd_netlink_message_append_u32(m, IFLA_MASTER, bridge_ifi);
 278         if (r < 0)
 279                 return r;
 280
 281         r = sd_netlink_call(rtnl, m, 0, NULL);
 282         if (r < 0)
 283                 return r;
 284
 285         return bridge_ifi;
 286 }
 287
 288 static int create_bridge(sd_netlink *rtnl, const char *bridge_name) {
 289         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 290         int r;
 291
 292         r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 293         if (r < 0)
 294                 return r;
 295
 296         r = sd_netlink_message_append_string(m, IFLA_IFNAME, bridge_name);
 297         if (r < 0)
 298                 return r;
 299
 300         r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 301         if (r < 0)
 302                 return r;
 303
 304         r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "bridge");
 305         if (r < 0)
 306                 return r;
 307
 308         r = sd_netlink_message_close_container(m);
 309         if (r < 0)
 310                 return r;
 311
 312         r = sd_netlink_message_close_container(m);
 313         if (r < 0)
 314                 return r;
 315
 316         r = sd_netlink_call(rtnl, m, 0, NULL);
 317         if (r < 0)
 318                 return r;
 319
 320         return 0;
 321 }
 322
 323 int setup_bridge(const char *veth_name, const char *bridge_name, bool create) {
 324         _cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
 325         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 326         int r, bridge_ifi;
 327         unsigned n = 0;
 328
 329         assert(veth_name);
 330         assert(bridge_name);
 331
 332         r = sd_netlink_open(&rtnl);
 333         if (r < 0)
 334                 return log_error_errno(r, "Failed to connect to netlink: %m");
 335
 336         if (create) {
 337                 /* We take a system-wide lock here, so that we can safely check whether there's still a member in the
 338                  * bridge before removing it, without risking interference from other nspawn instances. */
 339
 340                 r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
 341                 if (r < 0)
 342                         return log_error_errno(r, "Failed to take network zone lock: %m");
 343         }
 344
 345         for (;;) {
 346                 bridge_ifi = join_bridge(rtnl, veth_name, bridge_name);
 347                 if (bridge_ifi >= 0)
 348                         return bridge_ifi;
 349                 if (bridge_ifi != -ENODEV || !create || n > 10)
 350                         return log_error_errno(bridge_ifi, "Failed to add interface %s to bridge %s: %m", veth_name, bridge_name);
 351
 352                 /* Count attempts, so that we don't enter an endless loop here. */
 353                 n++;
 354
 355                 /* The bridge doesn't exist yet. Let's create it */
 356                 r = create_bridge(rtnl, bridge_name);
 357                 if (r < 0)
 358                         return log_error_errno(r, "Failed to create bridge interface %s: %m", bridge_name);
 359
 360                 /* Try again, now that the bridge exists */
 361         }
 362 }
 363
 364 int remove_bridge(const char *bridge_name) {
 365         _cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
 366         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 367         const char *path;
 368         int r;
 369
 370         /* Removes the specified bridge, but only if it is currently empty */
 371
 372         if (isempty(bridge_name))
 373                 return 0;
 374
 375         r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
 376         if (r < 0)
 377                 return log_error_errno(r, "Failed to take network zone lock: %m");
 378
 379         path = strjoina("/sys/class/net/", bridge_name, "/brif");
 380
 381         r = dir_is_empty(path);
 382         if (r == -ENOENT) /* Already gone? */
 383                 return 0;
 384         if (r < 0)
 385                 return log_error_errno(r, "Can't detect if bridge %s is empty: %m", bridge_name);
 386         if (r == 0) /* Still populated, leave it around */
 387                 return 0;
 388
 389         r = sd_netlink_open(&rtnl);
 390         if (r < 0)
 391                 return log_error_errno(r, "Failed to connect to netlink: %m");
 392
 393         return remove_one_link(rtnl, bridge_name);
 394 }
 395
 396 static int parse_interface(const char *name) {
 397         _cleanup_(sd_device_unrefp) sd_device *d = NULL;
 398         char ifi_str[2 + DECIMAL_STR_MAX(int)];
 399         int ifi, r;
 400
 401         ifi = (int) if_nametoindex(name);
 402         if (ifi <= 0)
 403                 return log_error_errno(errno, "Failed to resolve interface %s: %m", name);
 404
 405         sprintf(ifi_str, "n%i", ifi);
 406         r = sd_device_new_from_device_id(&d, ifi_str);
 407         if (r < 0)
 408                 return log_error_errno(r, "Failed to get device for interface %s: %m", name);
 409
 410         r = sd_device_get_is_initialized(d);
 411         if (r < 0)
 412                 return log_error_errno(r, "Failed to determine whether interface %s is initialized or not: %m", name);
 413         if (r == 0) {
 414                 log_error("Network interface %s is not initialized yet.", name);
 415                 return -EBUSY;
 416         }
 417
 418         return ifi;
 419 }
 420
 421 int move_network_interfaces(pid_t pid, char **ifaces) {
 422         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 423         char **i;
 424         int r;
 425
 426         if (strv_isempty(ifaces))
 427                 return 0;
 428
 429         r = sd_netlink_open(&rtnl);
 430         if (r < 0)
 431                 return log_error_errno(r, "Failed to connect to netlink: %m");
 432
 433         STRV_FOREACH(i, ifaces) {
 434                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 435                 int ifi;
 436
 437                 ifi = parse_interface(*i);
 438                 if (ifi < 0)
 439                         return ifi;
 440
 441                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
 442                 if (r < 0)
 443                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 444
 445                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 446                 if (r < 0)
 447                         return log_error_errno(r, "Failed to append namespace PID to netlink message: %m");
 448
 449                 r = sd_netlink_call(rtnl, m, 0, NULL);
 450                 if (r < 0)
 451                         return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
 452         }
 453
 454         return 0;
 455 }
 456
 457 int setup_macvlan(const char *machine_name, pid_t pid, char **ifaces) {
 458         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 459         unsigned idx = 0;
 460         char **i;
 461         int r;
 462
 463         if (strv_isempty(ifaces))
 464                 return 0;
 465
 466         r = sd_netlink_open(&rtnl);
 467         if (r < 0)
 468                 return log_error_errno(r, "Failed to connect to netlink: %m");
 469
 470         STRV_FOREACH(i, ifaces) {
 471                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 472                 _cleanup_free_ char *n = NULL;
 473                 struct ether_addr mac;
 474                 int ifi;
 475
 476                 ifi = parse_interface(*i);
 477                 if (ifi < 0)
 478                         return ifi;
 479
 480                 r = generate_mac(machine_name, &mac, MACVLAN_HASH_KEY, idx++);
 481                 if (r < 0)
 482                         return log_error_errno(r, "Failed to create MACVLAN MAC address: %m");
 483
 484                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 485                 if (r < 0)
 486                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 487
 488                 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
 489                 if (r < 0)
 490                         return log_error_errno(r, "Failed to add netlink interface index: %m");
 491
 492                 n = strappend("mv-", *i);
 493                 if (!n)
 494                         return log_oom();
 495
 496                 strshorten(n, IFNAMSIZ-1);
 497
 498                 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
 499                 if (r < 0)
 500                         return log_error_errno(r, "Failed to add netlink interface name: %m");
 501
 502                 r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
 503                 if (r < 0)
 504                         return log_error_errno(r, "Failed to add netlink MAC address: %m");
 505
 506                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 507                 if (r < 0)
 508                         return log_error_errno(r, "Failed to add netlink namespace field: %m");
 509
 510                 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 511                 if (r < 0)
 512                         return log_error_errno(r, "Failed to open netlink container: %m");
 513
 514                 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
 515                 if (r < 0)
 516                         return log_error_errno(r, "Failed to open netlink container: %m");
 517
 518                 r = sd_netlink_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
 519                 if (r < 0)
 520                         return log_error_errno(r, "Failed to append macvlan mode: %m");
 521
 522                 r = sd_netlink_message_close_container(m);
 523                 if (r < 0)
 524                         return log_error_errno(r, "Failed to close netlink container: %m");
 525
 526                 r = sd_netlink_message_close_container(m);
 527                 if (r < 0)
 528                         return log_error_errno(r, "Failed to close netlink container: %m");
 529
 530                 r = sd_netlink_call(rtnl, m, 0, NULL);
 531                 if (r < 0)
 532                         return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
 533         }
 534
 535         return 0;
 536 }
 537
 538 int setup_ipvlan(const char *machine_name, pid_t pid, char **ifaces) {
 539         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 540         char **i;
 541         int r;
 542
 543         if (strv_isempty(ifaces))
 544                 return 0;
 545
 546         r = sd_netlink_open(&rtnl);
 547         if (r < 0)
 548                 return log_error_errno(r, "Failed to connect to netlink: %m");
 549
 550         STRV_FOREACH(i, ifaces) {
 551                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 552                 _cleanup_free_ char *n = NULL;
 553                 int ifi;
 554
 555                 ifi = parse_interface(*i);
 556                 if (ifi < 0)
 557                         return ifi;
 558
 559                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 560                 if (r < 0)
 561                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 562
 563                 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
 564                 if (r < 0)
 565                         return log_error_errno(r, "Failed to add netlink interface index: %m");
 566
 567                 n = strappend("iv-", *i);
 568                 if (!n)
 569                         return log_oom();
 570
 571                 strshorten(n, IFNAMSIZ-1);
 572
 573                 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
 574                 if (r < 0)
 575                         return log_error_errno(r, "Failed to add netlink interface name: %m");
 576
 577                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 578                 if (r < 0)
 579                         return log_error_errno(r, "Failed to add netlink namespace field: %m");
 580
 581                 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 582                 if (r < 0)
 583                         return log_error_errno(r, "Failed to open netlink container: %m");
 584
 585                 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "ipvlan");
 586                 if (r < 0)
 587                         return log_error_errno(r, "Failed to open netlink container: %m");
 588
 589                 r = sd_netlink_message_append_u16(m, IFLA_IPVLAN_MODE, IPVLAN_MODE_L2);
 590                 if (r < 0)
 591                         return log_error_errno(r, "Failed to add ipvlan mode: %m");
 592
 593                 r = sd_netlink_message_close_container(m);
 594                 if (r < 0)
 595                         return log_error_errno(r, "Failed to close netlink container: %m");
 596
 597                 r = sd_netlink_message_close_container(m);
 598                 if (r < 0)
 599                         return log_error_errno(r, "Failed to close netlink container: %m");
 600
 601                 r = sd_netlink_call(rtnl, m, 0, NULL);
 602                 if (r < 0)
 603                         return log_error_errno(r, "Failed to add new ipvlan interfaces: %m");
 604         }
 605
 606         return 0;
 607 }
 608
 609 int veth_extra_parse(char ***l, const char *p) {
 610         _cleanup_free_ char *a = NULL, *b = NULL;
 611         int r;
 612
 613         r = extract_first_word(&p, &a, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 614         if (r < 0)
 615                 return r;
 616         if (r == 0 || !ifname_valid(a))
 617                 return -EINVAL;
 618
 619         r = extract_first_word(&p, &b, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 620         if (r < 0)
 621                 return r;
 622         if (r == 0 || !ifname_valid(b)) {
 623                 free(b);
 624                 b = strdup(a);
 625                 if (!b)
 626                         return -ENOMEM;
 627         }
 628
 629         if (p)
 630                 return -EINVAL;
 631
 632         r = strv_push_pair(l, a, b);
 633         if (r < 0)
 634                 return -ENOMEM;
 635
 636         a = b = NULL;
 637         return 0;
 638 }
 639
 640 int remove_veth_links(const char *primary, char **pairs) {
 641         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 642         char **a, **b;
 643         int r;
 644
 645         /* In some cases the kernel might pin the veth links between host and container even after the namespace
 646          * died. Hence, let's better remove them explicitly too. */
 647
 648         if (isempty(primary) && strv_isempty(pairs))
 649                 return 0;
 650
 651         r = sd_netlink_open(&rtnl);
 652         if (r < 0)
 653                 return log_error_errno(r, "Failed to connect to netlink: %m");
 654
 655         remove_one_link(rtnl, primary);
 656
 657         STRV_FOREACH_PAIR(a, b, pairs)
 658                 remove_one_link(rtnl, *a);
 659
 660         return 0;
 661 }