src/nspawn/nspawn-network.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <net/if.h>
   4 #include <linux/if.h>
   5 #include <linux/veth.h>
   6 #include <sys/file.h>
   7
   8 #include "sd-device.h"
   9 #include "sd-id128.h"
  10 #include "sd-netlink.h"
  11
  12 #include "alloc-util.h"
  13 #include "ether-addr-util.h"
  14 #include "hexdecoct.h"
  15 #include "lock-util.h"
  16 #include "missing_network.h"
  17 #include "netif-naming-scheme.h"
  18 #include "netlink-util.h"
  19 #include "nspawn-network.h"
  20 #include "parse-util.h"
  21 #include "siphash24.h"
  22 #include "socket-netlink.h"
  23 #include "socket-util.h"
  24 #include "stat-util.h"
  25 #include "string-util.h"
  26 #include "strv.h"
  27 #include "udev-util.h"
  28
  29 #define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
  30 #define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
  31 #define VETH_EXTRA_HOST_HASH_KEY SD_ID128_MAKE(48,c7,f6,b7,ea,9d,4c,9e,b7,28,d4,de,91,d5,bf,66)
  32 #define VETH_EXTRA_CONTAINER_HASH_KEY SD_ID128_MAKE(af,50,17,61,ce,f9,4d,35,84,0d,2b,20,54,be,ce,59)
  33 #define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)
  34 #define SHORTEN_IFNAME_HASH_KEY SD_ID128_MAKE(e1,90,a4,04,a8,ef,4b,51,8c,cc,c3,3a,9f,11,fc,a2)
  35
  36 static int remove_one_link(sd_netlink *rtnl, const char *name) {
  37         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
  38         int r;
  39
  40         if (isempty(name))
  41                 return 0;
  42
  43         r = sd_rtnl_message_new_link(rtnl, &m, RTM_DELLINK, 0);
  44         if (r < 0)
  45                 return log_error_errno(r, "Failed to allocate netlink message: %m");
  46
  47         r = sd_netlink_message_append_string(m, IFLA_IFNAME, name);
  48         if (r < 0)
  49                 return log_error_errno(r, "Failed to add netlink interface name: %m");
  50
  51         r = sd_netlink_call(rtnl, m, 0, NULL);
  52         if (r == -ENODEV) /* Already gone */
  53                 return 0;
  54         if (r < 0)
  55                 return log_error_errno(r, "Failed to remove interface %s: %m", name);
  56
  57         return 1;
  58 }
  59
  60 static int generate_mac(
  61                 const char *machine_name,
  62                 struct ether_addr *mac,
  63                 sd_id128_t hash_key,
  64                 uint64_t idx) {
  65
  66         uint64_t result;
  67         size_t l, sz;
  68         uint8_t *v, *i;
  69         int r;
  70
  71         l = strlen(machine_name);
  72         sz = sizeof(sd_id128_t) + l;
  73         if (idx > 0)
  74                 sz += sizeof(idx);
  75
  76         v = newa(uint8_t, sz);
  77
  78         /* fetch some persistent data unique to the host */
  79         r = sd_id128_get_machine((sd_id128_t*) v);
  80         if (r < 0)
  81                 return r;
  82
  83         /* combine with some data unique (on this host) to this
  84          * container instance */
  85         i = mempcpy(v + sizeof(sd_id128_t), machine_name, l);
  86         if (idx > 0) {
  87                 idx = htole64(idx);
  88                 memcpy(i, &idx, sizeof(idx));
  89         }
  90
  91         /* Let's hash the host machine ID plus the container name. We
  92          * use a fixed, but originally randomly created hash key here. */
  93         result = htole64(siphash24(v, sz, hash_key.bytes));
  94
  95         assert_cc(ETH_ALEN <= sizeof(result));
  96         memcpy(mac->ether_addr_octet, &result, ETH_ALEN);
  97
  98         /* see eth_random_addr in the kernel */
  99         mac->ether_addr_octet[0] &= 0xfe;        /* clear multicast bit */
 100         mac->ether_addr_octet[0] |= 0x02;        /* set local assignment bit (IEEE802) */
 101
 102         return 0;
 103 }
 104
 105 static int set_alternative_ifname(sd_netlink *rtnl, const char *ifname, const char *altifname) {
 106         int r;
 107
 108         assert(rtnl);
 109         assert(ifname);
 110
 111         if (!altifname)
 112                 return 0;
 113
 114         if (strlen(altifname) >= ALTIFNAMSIZ)
 115                 return log_warning_errno(SYNTHETIC_ERRNO(ERANGE),
 116                                          "Alternative interface name '%s' for '%s' is too long, ignoring",
 117                                          altifname, ifname);
 118
 119         r = rtnl_set_link_alternative_names_by_ifname(&rtnl, ifname, STRV_MAKE(altifname));
 120         if (r < 0)
 121                 return log_warning_errno(r,
 122                                          "Failed to set alternative interface name '%s' to '%s', ignoring: %m",
 123                                          altifname, ifname);
 124
 125         return 0;
 126 }
 127
 128 static int add_veth(
 129                 sd_netlink *rtnl,
 130                 pid_t pid,
 131                 const char *ifname_host,
 132                 const char *altifname_host,
 133                 const struct ether_addr *mac_host,
 134                 const char *ifname_container,
 135                 const struct ether_addr *mac_container) {
 136
 137         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 138         int r;
 139
 140         assert(rtnl);
 141         assert(ifname_host);
 142         assert(mac_host);
 143         assert(ifname_container);
 144         assert(mac_container);
 145
 146         r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 147         if (r < 0)
 148                 return log_error_errno(r, "Failed to allocate netlink message: %m");
 149
 150         r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_host);
 151         if (r < 0)
 152                 return log_error_errno(r, "Failed to add netlink interface name: %m");
 153
 154         r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_host);
 155         if (r < 0)
 156                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
 157
 158         r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 159         if (r < 0)
 160                 return log_error_errno(r, "Failed to open netlink container: %m");
 161
 162         r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "veth");
 163         if (r < 0)
 164                 return log_error_errno(r, "Failed to open netlink container: %m");
 165
 166         r = sd_netlink_message_open_container(m, VETH_INFO_PEER);
 167         if (r < 0)
 168                 return log_error_errno(r, "Failed to open netlink container: %m");
 169
 170         r = sd_netlink_message_append_string(m, IFLA_IFNAME, ifname_container);
 171         if (r < 0)
 172                 return log_error_errno(r, "Failed to add netlink interface name: %m");
 173
 174         r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, mac_container);
 175         if (r < 0)
 176                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
 177
 178         r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 179         if (r < 0)
 180                 return log_error_errno(r, "Failed to add netlink namespace field: %m");
 181
 182         r = sd_netlink_message_close_container(m);
 183         if (r < 0)
 184                 return log_error_errno(r, "Failed to close netlink container: %m");
 185
 186         r = sd_netlink_message_close_container(m);
 187         if (r < 0)
 188                 return log_error_errno(r, "Failed to close netlink container: %m");
 189
 190         r = sd_netlink_message_close_container(m);
 191         if (r < 0)
 192                 return log_error_errno(r, "Failed to close netlink container: %m");
 193
 194         r = sd_netlink_call(rtnl, m, 0, NULL);
 195         if (r < 0)
 196                 return log_error_errno(r, "Failed to add new veth interfaces (%s:%s): %m", ifname_host, ifname_container);
 197
 198         (void) set_alternative_ifname(rtnl, ifname_host, altifname_host);
 199
 200         return 0;
 201 }
 202
 203 static int shorten_ifname(char *ifname) {
 204         char new_ifname[IFNAMSIZ];
 205
 206         assert(ifname);
 207
 208         if (strlen(ifname) < IFNAMSIZ) /* Name is short enough */
 209                 return 0;
 210
 211         if (naming_scheme_has(NAMING_NSPAWN_LONG_HASH)) {
 212                 uint64_t h;
 213
 214                 /* Calculate 64-bit hash value */
 215                 h = siphash24(ifname, strlen(ifname), SHORTEN_IFNAME_HASH_KEY.bytes);
 216
 217                 /* Set the final four bytes (i.e. 32-bit) to the lower 24bit of the hash, encoded in url-safe base64 */
 218                 memcpy(new_ifname, ifname, IFNAMSIZ - 5);
 219                 new_ifname[IFNAMSIZ - 5] = urlsafe_base64char(h >> 18);
 220                 new_ifname[IFNAMSIZ - 4] = urlsafe_base64char(h >> 12);
 221                 new_ifname[IFNAMSIZ - 3] = urlsafe_base64char(h >> 6);
 222                 new_ifname[IFNAMSIZ - 2] = urlsafe_base64char(h);
 223         } else
 224                 /* On old nspawn versions we just truncated the name, provide compatibility */
 225                 memcpy(new_ifname, ifname, IFNAMSIZ-1);
 226
 227         new_ifname[IFNAMSIZ - 1] = 0;
 228
 229         /* Log the incident to make it more discoverable */
 230         log_warning("Network interface name '%s' has been changed to '%s' to fit length constraints.", ifname, new_ifname);
 231
 232         strcpy(ifname, new_ifname);
 233         return 1;
 234 }
 235
 236 int setup_veth(const char *machine_name,
 237                pid_t pid,
 238                char iface_name[IFNAMSIZ],
 239                bool bridge,
 240                const struct ether_addr *provided_mac) {
 241
 242         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 243         struct ether_addr mac_host, mac_container;
 244         unsigned u;
 245         char *n, *a = NULL;
 246         int r;
 247
 248         assert(machine_name);
 249         assert(pid > 0);
 250         assert(iface_name);
 251
 252         /* Use two different interface name prefixes depending whether
 253          * we are in bridge mode or not. */
 254         n = strjoina(bridge ? "vb-" : "ve-", machine_name);
 255         r = shorten_ifname(n);
 256         if (r > 0)
 257                 a = strjoina(bridge ? "vb-" : "ve-", machine_name);
 258
 259         if (ether_addr_is_null(provided_mac)){
 260                 r = generate_mac(machine_name, &mac_container, CONTAINER_HASH_KEY, 0);
 261                 if (r < 0)
 262                         return log_error_errno(r, "Failed to generate predictable MAC address for container side: %m");
 263         } else
 264                 mac_container = *provided_mac;
 265
 266         r = generate_mac(machine_name, &mac_host, HOST_HASH_KEY, 0);
 267         if (r < 0)
 268                 return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");
 269
 270         r = sd_netlink_open(&rtnl);
 271         if (r < 0)
 272                 return log_error_errno(r, "Failed to connect to netlink: %m");
 273
 274         r = add_veth(rtnl, pid, n, a, &mac_host, "host0", &mac_container);
 275         if (r < 0)
 276                 return r;
 277
 278         u = if_nametoindex(n); /* We don't need to use rtnl_resolve_ifname() here because the
 279                                 * name we assigned is always the main name. */
 280         if (u == 0)
 281                 return log_error_errno(errno, "Failed to resolve interface %s: %m", n);
 282
 283         strcpy(iface_name, n);
 284         return (int) u;
 285 }
 286
 287 int setup_veth_extra(
 288                 const char *machine_name,
 289                 pid_t pid,
 290                 char **pairs) {
 291
 292         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 293         uint64_t idx = 0;
 294         int r;
 295
 296         assert(machine_name);
 297         assert(pid > 0);
 298
 299         if (strv_isempty(pairs))
 300                 return 0;
 301
 302         r = sd_netlink_open(&rtnl);
 303         if (r < 0)
 304                 return log_error_errno(r, "Failed to connect to netlink: %m");
 305
 306         STRV_FOREACH_PAIR(a, b, pairs) {
 307                 struct ether_addr mac_host, mac_container;
 308
 309                 r = generate_mac(machine_name, &mac_container, VETH_EXTRA_CONTAINER_HASH_KEY, idx);
 310                 if (r < 0)
 311                         return log_error_errno(r, "Failed to generate predictable MAC address for container side of extra veth link: %m");
 312
 313                 r = generate_mac(machine_name, &mac_host, VETH_EXTRA_HOST_HASH_KEY, idx);
 314                 if (r < 0)
 315                         return log_error_errno(r, "Failed to generate predictable MAC address for host side of extra veth link: %m");
 316
 317                 r = add_veth(rtnl, pid, *a, NULL, &mac_host, *b, &mac_container);
 318                 if (r < 0)
 319                         return r;
 320
 321                 idx++;
 322         }
 323
 324         return 0;
 325 }
 326
 327 static int join_bridge(sd_netlink *rtnl, const char *veth_name, const char *bridge_name) {
 328         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 329         int r, bridge_ifi;
 330
 331         assert(rtnl);
 332         assert(veth_name);
 333         assert(bridge_name);
 334
 335         bridge_ifi = rtnl_resolve_interface(&rtnl, bridge_name);
 336         if (bridge_ifi < 0)
 337                 return bridge_ifi;
 338
 339         r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
 340         if (r < 0)
 341                 return r;
 342
 343         r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
 344         if (r < 0)
 345                 return r;
 346
 347         r = sd_netlink_message_append_string(m, IFLA_IFNAME, veth_name);
 348         if (r < 0)
 349                 return r;
 350
 351         r = sd_netlink_message_append_u32(m, IFLA_MASTER, bridge_ifi);
 352         if (r < 0)
 353                 return r;
 354
 355         r = sd_netlink_call(rtnl, m, 0, NULL);
 356         if (r < 0)
 357                 return r;
 358
 359         return bridge_ifi;
 360 }
 361
 362 static int create_bridge(sd_netlink *rtnl, const char *bridge_name) {
 363         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 364         int r;
 365
 366         r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 367         if (r < 0)
 368                 return r;
 369
 370         r = sd_netlink_message_append_string(m, IFLA_IFNAME, bridge_name);
 371         if (r < 0)
 372                 return r;
 373
 374         r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 375         if (r < 0)
 376                 return r;
 377
 378         r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "bridge");
 379         if (r < 0)
 380                 return r;
 381
 382         r = sd_netlink_message_close_container(m);
 383         if (r < 0)
 384                 return r;
 385
 386         r = sd_netlink_message_close_container(m);
 387         if (r < 0)
 388                 return r;
 389
 390         r = sd_netlink_call(rtnl, m, 0, NULL);
 391         if (r < 0)
 392                 return r;
 393
 394         return 0;
 395 }
 396
 397 int setup_bridge(const char *veth_name, const char *bridge_name, bool create) {
 398         _cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
 399         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 400         int r, bridge_ifi;
 401         unsigned n = 0;
 402
 403         assert(veth_name);
 404         assert(bridge_name);
 405
 406         r = sd_netlink_open(&rtnl);
 407         if (r < 0)
 408                 return log_error_errno(r, "Failed to connect to netlink: %m");
 409
 410         if (create) {
 411                 /* We take a system-wide lock here, so that we can safely check whether there's still a member in the
 412                  * bridge before removing it, without risking interference from other nspawn instances. */
 413
 414                 r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
 415                 if (r < 0)
 416                         return log_error_errno(r, "Failed to take network zone lock: %m");
 417         }
 418
 419         for (;;) {
 420                 bridge_ifi = join_bridge(rtnl, veth_name, bridge_name);
 421                 if (bridge_ifi >= 0)
 422                         return bridge_ifi;
 423                 if (bridge_ifi != -ENODEV || !create || n > 10)
 424                         return log_error_errno(bridge_ifi, "Failed to add interface %s to bridge %s: %m", veth_name, bridge_name);
 425
 426                 /* Count attempts, so that we don't enter an endless loop here. */
 427                 n++;
 428
 429                 /* The bridge doesn't exist yet. Let's create it */
 430                 r = create_bridge(rtnl, bridge_name);
 431                 if (r < 0)
 432                         return log_error_errno(r, "Failed to create bridge interface %s: %m", bridge_name);
 433
 434                 /* Try again, now that the bridge exists */
 435         }
 436 }
 437
 438 int remove_bridge(const char *bridge_name) {
 439         _cleanup_(release_lock_file) LockFile bridge_lock = LOCK_FILE_INIT;
 440         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 441         const char *path;
 442         int r;
 443
 444         /* Removes the specified bridge, but only if it is currently empty */
 445
 446         if (isempty(bridge_name))
 447                 return 0;
 448
 449         r = make_lock_file("/run/systemd/nspawn-network-zone", LOCK_EX, &bridge_lock);
 450         if (r < 0)
 451                 return log_error_errno(r, "Failed to take network zone lock: %m");
 452
 453         path = strjoina("/sys/class/net/", bridge_name, "/brif");
 454
 455         r = dir_is_empty(path, /* ignore_hidden_or_backup= */ false);
 456         if (r == -ENOENT) /* Already gone? */
 457                 return 0;
 458         if (r < 0)
 459                 return log_error_errno(r, "Can't detect if bridge %s is empty: %m", bridge_name);
 460         if (r == 0) /* Still populated, leave it around */
 461                 return 0;
 462
 463         r = sd_netlink_open(&rtnl);
 464         if (r < 0)
 465                 return log_error_errno(r, "Failed to connect to netlink: %m");
 466
 467         return remove_one_link(rtnl, bridge_name);
 468 }
 469
 470 static int test_network_interface_initialized(const char *name) {
 471         _cleanup_(sd_device_unrefp) sd_device *d = NULL;
 472         int r;
 473
 474         if (!udev_available())
 475                 return 0;
 476
 477         /* udev should be around. */
 478
 479         r = sd_device_new_from_ifname(&d, name);
 480         if (r < 0)
 481                 return log_error_errno(r, "Failed to get device %s: %m", name);
 482
 483         r = sd_device_get_is_initialized(d);
 484         if (r < 0)
 485                 return log_error_errno(r, "Failed to determine whether interface %s is initialized: %m", name);
 486         if (r == 0)
 487                 return log_error_errno(SYNTHETIC_ERRNO(EBUSY), "Network interface %s is not initialized yet.", name);
 488
 489         r = device_is_renaming(d);
 490         if (r < 0)
 491                 return log_error_errno(r, "Failed to determine the interface %s is being renamed: %m", name);
 492         if (r > 0)
 493                 return log_error_errno(SYNTHETIC_ERRNO(EBUSY), "Interface %s is being renamed.", name);
 494
 495         return 0;
 496 }
 497
 498 int test_network_interfaces_initialized(char **iface_pairs) {
 499         int r;
 500         STRV_FOREACH_PAIR(a, b, iface_pairs) {
 501                 r = test_network_interface_initialized(*a);
 502                 if (r < 0)
 503                         return r;
 504         }
 505         return 0;
 506 }
 507
 508 int move_network_interfaces(int netns_fd, char **iface_pairs) {
 509         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 510         int r;
 511
 512         if (strv_isempty(iface_pairs))
 513                 return 0;
 514
 515         r = sd_netlink_open(&rtnl);
 516         if (r < 0)
 517                 return log_error_errno(r, "Failed to connect to netlink: %m");
 518
 519         STRV_FOREACH_PAIR(i, b, iface_pairs) {
 520                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 521                 int ifi;
 522
 523                 ifi = rtnl_resolve_interface_or_warn(&rtnl, *i);
 524                 if (ifi < 0)
 525                         return ifi;
 526
 527                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
 528                 if (r < 0)
 529                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 530
 531                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_FD, netns_fd);
 532                 if (r < 0)
 533                         return log_error_errno(r, "Failed to append namespace fd to netlink message: %m");
 534
 535                 if (!streq(*b, *i)) {
 536                         r = sd_netlink_message_append_string(m, IFLA_IFNAME, *b);
 537                         if (r < 0)
 538                                 return log_error_errno(r, "Failed to add netlink interface name: %m");
 539                 }
 540
 541                 r = sd_netlink_call(rtnl, m, 0, NULL);
 542                 if (r < 0)
 543                         return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
 544         }
 545
 546         return 0;
 547 }
 548
 549 int setup_macvlan(const char *machine_name, pid_t pid, char **iface_pairs) {
 550         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 551         unsigned idx = 0;
 552         int r;
 553
 554         if (strv_isempty(iface_pairs))
 555                 return 0;
 556
 557         r = sd_netlink_open(&rtnl);
 558         if (r < 0)
 559                 return log_error_errno(r, "Failed to connect to netlink: %m");
 560
 561         STRV_FOREACH_PAIR(i, b, iface_pairs) {
 562                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 563                 _cleanup_free_ char *n = NULL;
 564                 int shortened, ifi;
 565                 struct ether_addr mac;
 566
 567                 ifi = rtnl_resolve_interface_or_warn(&rtnl, *i);
 568                 if (ifi < 0)
 569                         return ifi;
 570
 571                 r = generate_mac(machine_name, &mac, MACVLAN_HASH_KEY, idx++);
 572                 if (r < 0)
 573                         return log_error_errno(r, "Failed to create MACVLAN MAC address: %m");
 574
 575                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 576                 if (r < 0)
 577                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 578
 579                 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
 580                 if (r < 0)
 581                         return log_error_errno(r, "Failed to add netlink interface index: %m");
 582
 583                 n = strdup(*b);
 584                 if (!n)
 585                         return log_oom();
 586
 587                 shortened = shorten_ifname(n);
 588
 589                 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
 590                 if (r < 0)
 591                         return log_error_errno(r, "Failed to add netlink interface name: %m");
 592
 593                 r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
 594                 if (r < 0)
 595                         return log_error_errno(r, "Failed to add netlink MAC address: %m");
 596
 597                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 598                 if (r < 0)
 599                         return log_error_errno(r, "Failed to add netlink namespace field: %m");
 600
 601                 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 602                 if (r < 0)
 603                         return log_error_errno(r, "Failed to open netlink container: %m");
 604
 605                 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
 606                 if (r < 0)
 607                         return log_error_errno(r, "Failed to open netlink container: %m");
 608
 609                 r = sd_netlink_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
 610                 if (r < 0)
 611                         return log_error_errno(r, "Failed to append macvlan mode: %m");
 612
 613                 r = sd_netlink_message_close_container(m);
 614                 if (r < 0)
 615                         return log_error_errno(r, "Failed to close netlink container: %m");
 616
 617                 r = sd_netlink_message_close_container(m);
 618                 if (r < 0)
 619                         return log_error_errno(r, "Failed to close netlink container: %m");
 620
 621                 r = sd_netlink_call(rtnl, m, 0, NULL);
 622                 if (r < 0)
 623                         return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
 624
 625                 if (shortened > 0)
 626                         (void) set_alternative_ifname(rtnl, n, *b);
 627         }
 628
 629         return 0;
 630 }
 631
 632 int setup_ipvlan(const char *machine_name, pid_t pid, char **iface_pairs) {
 633         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 634         int r;
 635
 636         if (strv_isempty(iface_pairs))
 637                 return 0;
 638
 639         r = sd_netlink_open(&rtnl);
 640         if (r < 0)
 641                 return log_error_errno(r, "Failed to connect to netlink: %m");
 642
 643         STRV_FOREACH_PAIR(i, b, iface_pairs) {
 644                 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 645                 _cleanup_free_ char *n = NULL;
 646                 int shortened, ifi ;
 647
 648                 ifi = rtnl_resolve_interface_or_warn(&rtnl, *i);
 649                 if (ifi < 0)
 650                         return ifi;
 651
 652                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
 653                 if (r < 0)
 654                         return log_error_errno(r, "Failed to allocate netlink message: %m");
 655
 656                 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
 657                 if (r < 0)
 658                         return log_error_errno(r, "Failed to add netlink interface index: %m");
 659
 660                 n = strdup(*b);
 661                 if (!n)
 662                         return log_oom();
 663
 664                 shortened = shorten_ifname(n);
 665
 666                 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
 667                 if (r < 0)
 668                         return log_error_errno(r, "Failed to add netlink interface name: %m");
 669
 670                 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
 671                 if (r < 0)
 672                         return log_error_errno(r, "Failed to add netlink namespace field: %m");
 673
 674                 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
 675                 if (r < 0)
 676                         return log_error_errno(r, "Failed to open netlink container: %m");
 677
 678                 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "ipvlan");
 679                 if (r < 0)
 680                         return log_error_errno(r, "Failed to open netlink container: %m");
 681
 682                 r = sd_netlink_message_append_u16(m, IFLA_IPVLAN_MODE, IPVLAN_MODE_L2);
 683                 if (r < 0)
 684                         return log_error_errno(r, "Failed to add ipvlan mode: %m");
 685
 686                 r = sd_netlink_message_close_container(m);
 687                 if (r < 0)
 688                         return log_error_errno(r, "Failed to close netlink container: %m");
 689
 690                 r = sd_netlink_message_close_container(m);
 691                 if (r < 0)
 692                         return log_error_errno(r, "Failed to close netlink container: %m");
 693
 694                 r = sd_netlink_call(rtnl, m, 0, NULL);
 695                 if (r < 0)
 696                         return log_error_errno(r, "Failed to add new ipvlan interfaces: %m");
 697
 698                 if (shortened > 0)
 699                         (void) set_alternative_ifname(rtnl, n, *b);
 700         }
 701
 702         return 0;
 703 }
 704
 705 int veth_extra_parse(char ***l, const char *p) {
 706         _cleanup_free_ char *a = NULL, *b = NULL;
 707         int r;
 708
 709         r = extract_first_word(&p, &a, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 710         if (r < 0)
 711                 return r;
 712         if (r == 0 || !ifname_valid(a))
 713                 return -EINVAL;
 714
 715         r = extract_first_word(&p, &b, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 716         if (r < 0)
 717                 return r;
 718         if (r == 0 || !ifname_valid(b)) {
 719                 r = free_and_strdup(&b, a);
 720                 if (r < 0)
 721                         return r;
 722         }
 723
 724         if (p)
 725                 return -EINVAL;
 726
 727         r = strv_push_pair(l, a, b);
 728         if (r < 0)
 729                 return -ENOMEM;
 730
 731         a = b = NULL;
 732         return 0;
 733 }
 734
 735 int remove_veth_links(const char *primary, char **pairs) {
 736         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 737         int r;
 738
 739         /* In some cases the kernel might pin the veth links between host and container even after the namespace
 740          * died. Hence, let's better remove them explicitly too. */
 741
 742         if (isempty(primary) && strv_isempty(pairs))
 743                 return 0;
 744
 745         r = sd_netlink_open(&rtnl);
 746         if (r < 0)
 747                 return log_error_errno(r, "Failed to connect to netlink: %m");
 748
 749         remove_one_link(rtnl, primary);
 750
 751         STRV_FOREACH_PAIR(a, b, pairs)
 752                 remove_one_link(rtnl, *a);
 753
 754         return 0;
 755 }
 756
 757 static int network_iface_pair_parse(const char* iftype, char ***l, const char *p, const char* ifprefix) {
 758         int r;
 759
 760         for (;;) {
 761                 _cleanup_free_ char *word = NULL, *a = NULL, *b = NULL;
 762                 const char *interface;
 763
 764                 r = extract_first_word(&p, &word, NULL, 0);
 765                 if (r < 0)
 766                         return log_error_errno(r, "Failed to parse interface name: %m");
 767                 if (r == 0)
 768                         break;
 769
 770                 interface = word;
 771                 r = extract_first_word(&interface, &a, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 772                 if (r < 0)
 773                         return log_error_errno(r, "Failed to extract first word in %s parameter: %m", iftype);
 774                 if (r == 0)
 775                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 776                                                "Short read while reading %s parameter: %m", iftype);
 777                 if (!ifname_valid(a))
 778                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 779                                                "%s, interface name not valid: %s", iftype, a);
 780
 781                 /* Here, we only check the validity of the specified second name. If it is not specified,
 782                  * the copied or prefixed name should be already valid, except for its length. If it is too
 783                  * long, then it will be shortened later. */
 784                 if (!isempty(interface)) {
 785                         if (!ifname_valid(interface))
 786                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 787                                                        "%s, interface name not valid: %s", iftype, interface);
 788
 789                         b = strdup(interface);
 790                 } else if (ifprefix)
 791                         b = strjoin(ifprefix, a);
 792                 else
 793                         b = strdup(a);
 794                 if (!b)
 795                         return log_oom();
 796
 797                 r = strv_consume_pair(l, TAKE_PTR(a), TAKE_PTR(b));
 798                 if (r < 0)
 799                         return log_oom();
 800         }
 801
 802         return 0;
 803 }
 804
 805 int interface_pair_parse(char ***l, const char *p) {
 806         return network_iface_pair_parse("Network interface", l, p, NULL);
 807 }
 808
 809 int macvlan_pair_parse(char ***l, const char *p) {
 810         return network_iface_pair_parse("MACVLAN network interface", l, p, "mv-");
 811 }
 812
 813 int ipvlan_pair_parse(char ***l, const char *p) {
 814         return network_iface_pair_parse("IPVLAN network interface", l, p, "iv-");
 815 }