]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/network.c
projects / mirror_lxc.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #2821 from brauner/2019-02-05/remove_stack_allocation
[mirror_lxc.git] / src / lxc / network.c
1 /*
2 * lxc: linux Container library
3 *
4 * (C) Copyright IBM Corp. 2007, 2008
5 *
6 * Authors:
7 * Daniel Lezcano <daniel.lezcano at free.fr>
8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
22 */
23
24 #ifndef _GNU_SOURCE
25 #define _GNU_SOURCE 1
26 #endif
27 #include <arpa/inet.h>
28 #include <ctype.h>
29 #include <errno.h>
30 #include <fcntl.h>
31 #include <linux/netlink.h>
32 #include <linux/rtnetlink.h>
33 #include <linux/sockios.h>
34 #include <net/ethernet.h>
35 #include <net/if.h>
36 #include <net/if_arp.h>
37 #include <netinet/in.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <string.h>
41 #include <sys/inotify.h>
42 #include <sys/ioctl.h>
43 #include <sys/param.h>
44 #include <sys/socket.h>
45 #include <sys/stat.h>
46 #include <sys/types.h>
47 #include <time.h>
48 #include <unistd.h>
49
50 #include "../include/netns_ifaddrs.h"
51 #include "af_unix.h"
52 #include "conf.h"
53 #include "config.h"
54 #include "file_utils.h"
55 #include "log.h"
56 #include "macro.h"
57 #include "memory_utils.h"
58 #include "network.h"
59 #include "nl.h"
60 #include "raw_syscalls.h"
61 #include "syscall_wrappers.h"
62 #include "utils.h"
63
64 #ifndef HAVE_STRLCPY
65 #include "include/strlcpy.h"
66 #endif
67
68 lxc_log_define(network, lxc);
69
70 typedef int (*instantiate_cb)(struct lxc_handler *, struct lxc_netdev *);
71
72 static int instantiate_veth(struct lxc_handler *handler, struct lxc_netdev *netdev)
73 {
74 int bridge_index, err;
75 char *veth1, *veth2;
76 char veth1buf[IFNAMSIZ], veth2buf[IFNAMSIZ];
77 unsigned int mtu = 0;
78
79 if (netdev->priv.veth_attr.pair[0] != '\0') {
80 veth1 = netdev->priv.veth_attr.pair;
81 if (handler->conf->reboot)
82 lxc_netdev_delete_by_name(veth1);
83 } else {
84 err = snprintf(veth1buf, sizeof(veth1buf), "vethXXXXXX");
85 if (err < 0 || (size_t)err >= sizeof(veth1buf))
86 return -1;
87
88 veth1 = lxc_mkifname(veth1buf);
89 if (!veth1)
90 return -1;
91
92 /* store away for deconf */
93 memcpy(netdev->priv.veth_attr.veth1, veth1, IFNAMSIZ);
94 }
95
96 err = snprintf(veth2buf, sizeof(veth2buf), "vethXXXXXX");
97 if (err < 0 || (size_t)err >= sizeof(veth2buf))
98 return -1;
99
100 veth2 = lxc_mkifname(veth2buf);
101 if (!veth2)
102 goto out_delete;
103
104 err = lxc_veth_create(veth1, veth2);
105 if (err) {
106 errno = -err;
107 SYSERROR("Failed to create veth pair \"%s\" and \"%s\"", veth1, veth2);
108 goto out_delete;
109 }
110
111 /* changing the high byte of the mac address to 0xfe, the bridge interface
112 * will always keep the host's mac address and not take the mac address
113 * of a container */
114 err = setup_private_host_hw_addr(veth1);
115 if (err) {
116 errno = -err;
117 SYSERROR("Failed to change mac address of host interface \"%s\"", veth1);
118 goto out_delete;
119 }
120
121 /* Retrieve ifindex of the host's veth device. */
122 netdev->priv.veth_attr.ifindex = if_nametoindex(veth1);
123 if (!netdev->priv.veth_attr.ifindex) {
124 ERROR("Failed to retrieve ifindex for \"%s\"", veth1);
125 goto out_delete;
126 }
127
128 /* Note that we're retrieving the container's ifindex in the host's
129 * network namespace because we need it to move the device from the
130 * host's network namespace to the container's network namespace later
131 * on.
132 */
133 netdev->ifindex = if_nametoindex(veth2);
134 if (!netdev->ifindex) {
135 ERROR("Failed to retrieve ifindex for \"%s\"", veth2);
136 goto out_delete;
137 }
138
139 if (netdev->mtu) {
140 if (lxc_safe_uint(netdev->mtu, &mtu) < 0)
141 WARN("Failed to parse mtu");
142 else
143 INFO("Retrieved mtu %d", mtu);
144 } else if (netdev->link[0] != '\0') {
145 bridge_index = if_nametoindex(netdev->link);
146 if (bridge_index) {
147 mtu = netdev_get_mtu(bridge_index);
148 INFO("Retrieved mtu %d from %s", mtu, netdev->link);
149 } else {
150 mtu = netdev_get_mtu(netdev->ifindex);
151 INFO("Retrieved mtu %d from %s", mtu, veth2);
152 }
153 }
154
155 if (mtu) {
156 err = lxc_netdev_set_mtu(veth1, mtu);
157 if (!err)
158 err = lxc_netdev_set_mtu(veth2, mtu);
159
160 if (err) {
161 errno = -err;
162 SYSERROR("Failed to set mtu \"%d\" for veth pair \"%s\" "
163 "and \"%s\"", mtu, veth1, veth2);
164 goto out_delete;
165 }
166 }
167
168 if (netdev->link[0] != '\0') {
169 err = lxc_bridge_attach(netdev->link, veth1);
170 if (err) {
171 errno = -err;
172 SYSERROR("Failed to attach \"%s\" to bridge \"%s\"",
173 veth1, netdev->link);
174 goto out_delete;
175 }
176 INFO("Attached \"%s\" to bridge \"%s\"", veth1, netdev->link);
177 }
178
179 err = lxc_netdev_up(veth1);
180 if (err) {
181 errno = -err;
182 SYSERROR("Failed to set \"%s\" up", veth1);
183 goto out_delete;
184 }
185
186 if (netdev->upscript) {
187 char *argv[] = {
188 "veth",
189 netdev->link,
190 veth1,
191 NULL,
192 };
193
194 err = run_script_argv(handler->name,
195 handler->conf->hooks_version, "net",
196 netdev->upscript, "up", argv);
197 if (err < 0)
198 goto out_delete;
199 }
200
201 DEBUG("Instantiated veth \"%s/%s\", index is \"%d\"", veth1, veth2,
202 netdev->ifindex);
203
204 return 0;
205
206 out_delete:
207 if (netdev->ifindex != 0)
208 lxc_netdev_delete_by_name(veth1);
209 return -1;
210 }
211
212 static int instantiate_macvlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
213 {
214 char peerbuf[IFNAMSIZ], *peer;
215 int err;
216
217 if (netdev->link[0] == '\0') {
218 ERROR("No link for macvlan network device specified");
219 return -1;
220 }
221
222 err = snprintf(peerbuf, sizeof(peerbuf), "mcXXXXXX");
223 if (err < 0 || (size_t)err >= sizeof(peerbuf))
224 return -1;
225
226 peer = lxc_mkifname(peerbuf);
227 if (!peer)
228 return -1;
229
230 err = lxc_macvlan_create(netdev->link, peer,
231 netdev->priv.macvlan_attr.mode);
232 if (err) {
233 errno = -err;
234 SYSERROR("Failed to create macvlan interface \"%s\" on \"%s\"",
235 peer, netdev->link);
236 goto on_error;
237 }
238
239 netdev->ifindex = if_nametoindex(peer);
240 if (!netdev->ifindex) {
241 ERROR("Failed to retrieve ifindex for \"%s\"", peer);
242 goto on_error;
243 }
244
245 if (netdev->upscript) {
246 char *argv[] = {
247 "macvlan",
248 netdev->link,
249 NULL,
250 };
251
252 err = run_script_argv(handler->name,
253 handler->conf->hooks_version, "net",
254 netdev->upscript, "up", argv);
255 if (err < 0)
256 goto on_error;
257 }
258
259 DEBUG("Instantiated macvlan \"%s\" with ifindex is %d and mode %d",
260 peer, netdev->ifindex, netdev->priv.macvlan_attr.mode);
261
262 return 0;
263
264 on_error:
265 lxc_netdev_delete_by_name(peer);
266 return -1;
267 }
268
269 static int instantiate_vlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
270 {
271 char peer[IFNAMSIZ];
272 int err;
273 static uint16_t vlan_cntr = 0;
274 unsigned int mtu = 0;
275
276 if (netdev->link[0] == '\0') {
277 ERROR("No link for vlan network device specified");
278 return -1;
279 }
280
281 err = snprintf(peer, sizeof(peer), "vlan%d-%d", netdev->priv.vlan_attr.vid, vlan_cntr++);
282 if (err < 0 || (size_t)err >= sizeof(peer))
283 return -1;
284
285 err = lxc_vlan_create(netdev->link, peer, netdev->priv.vlan_attr.vid);
286 if (err) {
287 errno = -err;
288 SYSERROR("Failed to create vlan interface \"%s\" on \"%s\"",
289 peer, netdev->link);
290 return -1;
291 }
292
293 netdev->ifindex = if_nametoindex(peer);
294 if (!netdev->ifindex) {
295 ERROR("Failed to retrieve ifindex for \"%s\"", peer);
296 lxc_netdev_delete_by_name(peer);
297 return -1;
298 }
299
300 DEBUG("Instantiated vlan \"%s\" with ifindex is \"%d\" (vlan1000)",
301 peer, netdev->ifindex);
302 if (netdev->mtu) {
303 if (lxc_safe_uint(netdev->mtu, &mtu) < 0) {
304 ERROR("Failed to retrieve mtu from \"%d\"/\"%s\".",
305 netdev->ifindex,
306 netdev->name[0] != '\0' ? netdev->name : "(null)");
307 return -1;
308 }
309
310 err = lxc_netdev_set_mtu(peer, mtu);
311 if (err) {
312 errno = -err;
313 SYSERROR("Failed to set mtu \"%s\" for \"%s\"",
314 netdev->mtu, peer);
315 lxc_netdev_delete_by_name(peer);
316 return -1;
317 }
318 }
319
320 return 0;
321 }
322
323 static int instantiate_phys(struct lxc_handler *handler, struct lxc_netdev *netdev)
324 {
325 int ret;
326 char *argv[] = {
327 "phys",
328 netdev->link,
329 NULL,
330 };
331
332 if (netdev->link[0] == '\0') {
333 ERROR("No link for physical interface specified");
334 return -1;
335 }
336
337 /* Note that we're retrieving the container's ifindex in the host's
338 * network namespace because we need it to move the device from the
339 * host's network namespace to the container's network namespace later
340 * on.
341 * Note that netdev->link will contain the name of the physical network
342 * device in the host's namespace.
343 */
344 netdev->ifindex = if_nametoindex(netdev->link);
345 if (!netdev->ifindex) {
346 ERROR("Failed to retrieve ifindex for \"%s\"", netdev->link);
347 return -1;
348 }
349
350 /* Store the ifindex of the host's network device in the host's
351 * namespace.
352 */
353 netdev->priv.phys_attr.ifindex = netdev->ifindex;
354
355 if (!netdev->upscript)
356 return 0;
357
358 ret = run_script_argv(handler->name, handler->conf->hooks_version,
359 "net", netdev->upscript, "up", argv);
360 if (ret < 0)
361 return -1;
362
363 return 0;
364 }
365
366 static int instantiate_empty(struct lxc_handler *handler, struct lxc_netdev *netdev)
367 {
368 int ret;
369 char *argv[] = {
370 "empty",
371 NULL,
372 };
373
374 netdev->ifindex = 0;
375 if (!netdev->upscript)
376 return 0;
377
378 ret = run_script_argv(handler->name, handler->conf->hooks_version,
379 "net", netdev->upscript, "up", argv);
380 if (ret < 0)
381 return -1;
382
383 return 0;
384 }
385
386 static int instantiate_none(struct lxc_handler *handler, struct lxc_netdev *netdev)
387 {
388 netdev->ifindex = 0;
389 return 0;
390 }
391
392 static instantiate_cb netdev_conf[LXC_NET_MAXCONFTYPE + 1] = {
393 [LXC_NET_VETH] = instantiate_veth,
394 [LXC_NET_MACVLAN] = instantiate_macvlan,
395 [LXC_NET_VLAN] = instantiate_vlan,
396 [LXC_NET_PHYS] = instantiate_phys,
397 [LXC_NET_EMPTY] = instantiate_empty,
398 [LXC_NET_NONE] = instantiate_none,
399 };
400
401 static int shutdown_veth(struct lxc_handler *handler, struct lxc_netdev *netdev)
402 {
403 int ret;
404 char *argv[] = {
405 "veth",
406 netdev->link,
407 NULL,
408 NULL,
409 };
410
411 if (!netdev->downscript)
412 return 0;
413
414 if (netdev->priv.veth_attr.pair[0] != '\0')
415 argv[2] = netdev->priv.veth_attr.pair;
416 else
417 argv[2] = netdev->priv.veth_attr.veth1;
418
419 ret = run_script_argv(handler->name,
420 handler->conf->hooks_version, "net",
421 netdev->downscript, "down", argv);
422 if (ret < 0)
423 return -1;
424
425 return 0;
426 }
427
428 static int shutdown_macvlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
429 {
430 int ret;
431 char *argv[] = {
432 "macvlan",
433 netdev->link,
434 NULL,
435 };
436
437 if (!netdev->downscript)
438 return 0;
439
440 ret = run_script_argv(handler->name, handler->conf->hooks_version,
441 "net", netdev->downscript, "down", argv);
442 if (ret < 0)
443 return -1;
444
445 return 0;
446 }
447
448 static int shutdown_vlan(struct lxc_handler *handler, struct lxc_netdev *netdev)
449 {
450 return 0;
451 }
452
453 static int shutdown_phys(struct lxc_handler *handler, struct lxc_netdev *netdev)
454 {
455 int ret;
456 char *argv[] = {
457 "phys",
458 netdev->link,
459 NULL,
460 };
461
462 if (!netdev->downscript)
463 return 0;
464
465 ret = run_script_argv(handler->name, handler->conf->hooks_version,
466 "net", netdev->downscript, "down", argv);
467 if (ret < 0)
468 return -1;
469
470 return 0;
471 }
472
473 static int shutdown_empty(struct lxc_handler *handler, struct lxc_netdev *netdev)
474 {
475 int ret;
476 char *argv[] = {
477 "empty",
478 NULL,
479 };
480
481 if (!netdev->downscript)
482 return 0;
483
484 ret = run_script_argv(handler->name, handler->conf->hooks_version,
485 "net", netdev->downscript, "down", argv);
486 if (ret < 0)
487 return -1;
488
489 return 0;
490 }
491
492 static int shutdown_none(struct lxc_handler *handler, struct lxc_netdev *netdev)
493 {
494 return 0;
495 }
496
497 static instantiate_cb netdev_deconf[LXC_NET_MAXCONFTYPE + 1] = {
498 [LXC_NET_VETH] = shutdown_veth,
499 [LXC_NET_MACVLAN] = shutdown_macvlan,
500 [LXC_NET_VLAN] = shutdown_vlan,
501 [LXC_NET_PHYS] = shutdown_phys,
502 [LXC_NET_EMPTY] = shutdown_empty,
503 [LXC_NET_NONE] = shutdown_none,
504 };
505
506 int lxc_netdev_move_by_index(int ifindex, pid_t pid, const char *ifname)
507 {
508 int err;
509 struct nl_handler nlh;
510 struct ifinfomsg *ifi;
511 struct nlmsg *nlmsg = NULL;
512
513 err = netlink_open(&nlh, NETLINK_ROUTE);
514 if (err)
515 return err;
516
517 err = -ENOMEM;
518 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
519 if (!nlmsg)
520 goto out;
521
522 nlmsg->nlmsghdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
523 nlmsg->nlmsghdr->nlmsg_type = RTM_NEWLINK;
524
525 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
526 if (!ifi)
527 goto out;
528 ifi->ifi_family = AF_UNSPEC;
529 ifi->ifi_index = ifindex;
530
531 if (nla_put_u32(nlmsg, IFLA_NET_NS_PID, pid))
532 goto out;
533
534 if (ifname != NULL) {
535 if (nla_put_string(nlmsg, IFLA_IFNAME, ifname))
536 goto out;
537 }
538
539 err = netlink_transaction(&nlh, nlmsg, nlmsg);
540 out:
541 netlink_close(&nlh);
542 nlmsg_free(nlmsg);
543 return err;
544 }
545
546 /* If we are asked to move a wireless interface, then we must actually move its
547 * phyN device. Detect that condition and return the physname here. The physname
548 * will be passed to lxc_netdev_move_wlan() which will free it when done.
549 */
550 #define PHYSNAME "/sys/class/net/%s/phy80211/name"
551 static char *is_wlan(const char *ifname)
552 {
553 __do_free char *path;
554 int i, ret;
555 long physlen;
556 size_t len;
557 FILE *f;
558 char *physname = NULL;
559
560 len = strlen(ifname) + strlen(PHYSNAME) - 1;
561 path = must_realloc(NULL, len + 1);
562 ret = snprintf(path, len, PHYSNAME, ifname);
563 if (ret < 0 || (size_t)ret >= len)
564 goto bad;
565
566 f = fopen(path, "r");
567 if (!f)
568 goto bad;
569
570 /* Feh - sb.st_size is always 4096. */
571 fseek(f, 0, SEEK_END);
572 physlen = ftell(f);
573 fseek(f, 0, SEEK_SET);
574 if (physlen < 0) {
575 fclose(f);
576 goto bad;
577 }
578
579 physname = malloc(physlen + 1);
580 if (!physname) {
581 fclose(f);
582 goto bad;
583 }
584
585 memset(physname, 0, physlen + 1);
586 ret = fread(physname, 1, physlen, f);
587 fclose(f);
588 if (ret < 0)
589 goto bad;
590
591 for (i = 0; i < physlen; i++) {
592 if (physname[i] == '\n')
593 physname[i] = '\0';
594
595 if (physname[i] == '\0')
596 break;
597 }
598
599 return physname;
600
601 bad:
602 free(physname);
603 return NULL;
604 }
605
606 static int lxc_netdev_rename_by_name_in_netns(pid_t pid, const char *old,
607 const char *new)
608 {
609 pid_t fpid;
610
611 fpid = fork();
612 if (fpid < 0)
613 return -1;
614
615 if (fpid != 0)
616 return wait_for_pid(fpid);
617
618 if (!switch_to_ns(pid, "net"))
619 return -1;
620
621 _exit(lxc_netdev_rename_by_name(old, new));
622 }
623
624 static int lxc_netdev_move_wlan(char *physname, const char *ifname, pid_t pid,
625 const char *newname)
626 {
627 char *cmd;
628 pid_t fpid;
629 int err = -1;
630
631 /* Move phyN into the container. TODO - do this using netlink.
632 * However, IIUC this involves a bit more complicated work to talk to
633 * the 80211 module, so for now just call out to iw.
634 */
635 cmd = on_path("iw", NULL);
636 if (!cmd)
637 goto out1;
638 free(cmd);
639
640 fpid = fork();
641 if (fpid < 0)
642 goto out1;
643
644 if (fpid == 0) {
645 char pidstr[30];
646 sprintf(pidstr, "%d", pid);
647 execlp("iw", "iw", "phy", physname, "set", "netns", pidstr,
648 (char *)NULL);
649 _exit(EXIT_FAILURE);
650 }
651
652 if (wait_for_pid(fpid))
653 goto out1;
654
655 err = 0;
656 if (newname)
657 err = lxc_netdev_rename_by_name_in_netns(pid, ifname, newname);
658
659 out1:
660 free(physname);
661 return err;
662 }
663
664 int lxc_netdev_move_by_name(const char *ifname, pid_t pid, const char* newname)
665 {
666 int index;
667 char *physname;
668
669 if (!ifname)
670 return -EINVAL;
671
672 index = if_nametoindex(ifname);
673 if (!index)
674 return -EINVAL;
675
676 physname = is_wlan(ifname);
677 if (physname)
678 return lxc_netdev_move_wlan(physname, ifname, pid, newname);
679
680 return lxc_netdev_move_by_index(index, pid, newname);
681 }
682
683 int lxc_netdev_delete_by_index(int ifindex)
684 {
685 int err;
686 struct ifinfomsg *ifi;
687 struct nl_handler nlh;
688 struct nlmsg *answer = NULL, *nlmsg = NULL;
689
690 err = netlink_open(&nlh, NETLINK_ROUTE);
691 if (err)
692 return err;
693
694 err = -ENOMEM;
695 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
696 if (!nlmsg)
697 goto out;
698
699 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
700 if (!answer)
701 goto out;
702
703 nlmsg->nlmsghdr->nlmsg_flags = NLM_F_ACK | NLM_F_REQUEST;
704 nlmsg->nlmsghdr->nlmsg_type = RTM_DELLINK;
705
706 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
707 if (!ifi)
708 goto out;
709 ifi->ifi_family = AF_UNSPEC;
710 ifi->ifi_index = ifindex;
711
712 err = netlink_transaction(&nlh, nlmsg, answer);
713 out:
714 netlink_close(&nlh);
715 nlmsg_free(answer);
716 nlmsg_free(nlmsg);
717 return err;
718 }
719
720 int lxc_netdev_delete_by_name(const char *name)
721 {
722 int index;
723
724 index = if_nametoindex(name);
725 if (!index)
726 return -EINVAL;
727
728 return lxc_netdev_delete_by_index(index);
729 }
730
731 int lxc_netdev_rename_by_index(int ifindex, const char *newname)
732 {
733 int err, len;
734 struct ifinfomsg *ifi;
735 struct nl_handler nlh;
736 struct nlmsg *answer = NULL, *nlmsg = NULL;
737
738 err = netlink_open(&nlh, NETLINK_ROUTE);
739 if (err)
740 return err;
741
742 len = strlen(newname);
743 if (len == 1 || len >= IFNAMSIZ)
744 goto out;
745
746 err = -ENOMEM;
747 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
748 if (!nlmsg)
749 goto out;
750
751 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
752 if (!answer)
753 goto out;
754
755 nlmsg->nlmsghdr->nlmsg_flags = NLM_F_ACK | NLM_F_REQUEST;
756 nlmsg->nlmsghdr->nlmsg_type = RTM_NEWLINK;
757
758 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
759 if (!ifi)
760 goto out;
761 ifi->ifi_family = AF_UNSPEC;
762 ifi->ifi_index = ifindex;
763
764 if (nla_put_string(nlmsg, IFLA_IFNAME, newname))
765 goto out;
766
767 err = netlink_transaction(&nlh, nlmsg, answer);
768 out:
769 netlink_close(&nlh);
770 nlmsg_free(answer);
771 nlmsg_free(nlmsg);
772 return err;
773 }
774
775 int lxc_netdev_rename_by_name(const char *oldname, const char *newname)
776 {
777 int len, index;
778
779 len = strlen(oldname);
780 if (len == 1 || len >= IFNAMSIZ)
781 return -EINVAL;
782
783 index = if_nametoindex(oldname);
784 if (!index)
785 return -EINVAL;
786
787 return lxc_netdev_rename_by_index(index, newname);
788 }
789
790 int netdev_set_flag(const char *name, int flag)
791 {
792 int err, index, len;
793 struct ifinfomsg *ifi;
794 struct nl_handler nlh;
795 struct nlmsg *answer = NULL, *nlmsg = NULL;
796
797 err = netlink_open(&nlh, NETLINK_ROUTE);
798 if (err)
799 return err;
800
801 err = -EINVAL;
802 len = strlen(name);
803 if (len == 1 || len >= IFNAMSIZ)
804 goto out;
805
806 err = -ENOMEM;
807 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
808 if (!nlmsg)
809 goto out;
810
811 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
812 if (!answer)
813 goto out;
814
815 err = -EINVAL;
816 index = if_nametoindex(name);
817 if (!index)
818 goto out;
819
820 nlmsg->nlmsghdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
821 nlmsg->nlmsghdr->nlmsg_type = RTM_NEWLINK;
822
823 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
824 if (!ifi) {
825 err = -ENOMEM;
826 goto out;
827 }
828 ifi->ifi_family = AF_UNSPEC;
829 ifi->ifi_index = index;
830 ifi->ifi_change |= IFF_UP;
831 ifi->ifi_flags |= flag;
832
833 err = netlink_transaction(&nlh, nlmsg, answer);
834 out:
835 netlink_close(&nlh);
836 nlmsg_free(nlmsg);
837 nlmsg_free(answer);
838 return err;
839 }
840
841 int netdev_get_flag(const char *name, int *flag)
842 {
843 int err, index, len;
844 struct ifinfomsg *ifi;
845 struct nl_handler nlh;
846 struct nlmsg *answer = NULL, *nlmsg = NULL;
847
848 if (!name)
849 return -EINVAL;
850
851 err = netlink_open(&nlh, NETLINK_ROUTE);
852 if (err)
853 return err;
854
855 err = -EINVAL;
856 len = strlen(name);
857 if (len == 1 || len >= IFNAMSIZ)
858 goto out;
859
860 err = -ENOMEM;
861 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
862 if (!nlmsg)
863 goto out;
864
865 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
866 if (!answer)
867 goto out;
868
869 err = -EINVAL;
870 index = if_nametoindex(name);
871 if (!index)
872 goto out;
873
874 nlmsg->nlmsghdr->nlmsg_flags = NLM_F_REQUEST;
875 nlmsg->nlmsghdr->nlmsg_type = RTM_GETLINK;
876
877 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
878 if (!ifi) {
879 err = -ENOMEM;
880 goto out;
881 }
882 ifi->ifi_family = AF_UNSPEC;
883 ifi->ifi_index = index;
884
885 err = netlink_transaction(&nlh, nlmsg, answer);
886 if (err)
887 goto out;
888
889 ifi = NLMSG_DATA(answer->nlmsghdr);
890
891 *flag = ifi->ifi_flags;
892 out:
893 netlink_close(&nlh);
894 nlmsg_free(nlmsg);
895 nlmsg_free(answer);
896 return err;
897 }
898
899 /*
900 * \brief Check a interface is up or not.
901 *
902 * \param name: name for the interface.
903 *
904 * \return int.
905 * 0 means interface is down.
906 * 1 means interface is up.
907 * Others means error happened, and ret-value is the error number.
908 */
909 int lxc_netdev_isup(const char *name)
910 {
911 int err, flag;
912
913 err = netdev_get_flag(name, &flag);
914 if (err)
915 return err;
916
917 if (flag & IFF_UP)
918 return 1;
919
920 return 0;
921 }
922
923 int netdev_get_mtu(int ifindex)
924 {
925 int answer_len, err, res;
926 struct nl_handler nlh;
927 struct ifinfomsg *ifi;
928 struct nlmsghdr *msg;
929 int readmore = 0, recv_len = 0;
930 struct nlmsg *answer = NULL, *nlmsg = NULL;
931
932 err = netlink_open(&nlh, NETLINK_ROUTE);
933 if (err)
934 return err;
935
936 err = -ENOMEM;
937 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
938 if (!nlmsg)
939 goto out;
940
941 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
942 if (!answer)
943 goto out;
944
945 /* Save the answer buffer length, since it will be overwritten
946 * on the first receive (and we might need to receive more than
947 * once.
948 */
949 answer_len = answer->nlmsghdr->nlmsg_len;
950
951 nlmsg->nlmsghdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP;
952 nlmsg->nlmsghdr->nlmsg_type = RTM_GETLINK;
953
954 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
955 if (!ifi)
956 goto out;
957 ifi->ifi_family = AF_UNSPEC;
958
959 /* Send the request for addresses, which returns all addresses
960 * on all interfaces. */
961 err = netlink_send(&nlh, nlmsg);
962 if (err < 0)
963 goto out;
964
965 #pragma GCC diagnostic push
966 #pragma GCC diagnostic ignored "-Wcast-align"
967
968 do {
969 /* Restore the answer buffer length, it might have been
970 * overwritten by a previous receive.
971 */
972 answer->nlmsghdr->nlmsg_len = answer_len;
973
974 /* Get the (next) batch of reply messages */
975 err = netlink_rcv(&nlh, answer);
976 if (err < 0)
977 goto out;
978
979 recv_len = err;
980
981 /* Satisfy the typing for the netlink macros */
982 msg = answer->nlmsghdr;
983
984 while (NLMSG_OK(msg, recv_len)) {
985
986 /* Stop reading if we see an error message */
987 if (msg->nlmsg_type == NLMSG_ERROR) {
988 struct nlmsgerr *errmsg =
989 (struct nlmsgerr *)NLMSG_DATA(msg);
990 err = errmsg->error;
991 goto out;
992 }
993
994 /* Stop reading if we see a NLMSG_DONE message */
995 if (msg->nlmsg_type == NLMSG_DONE) {
996 readmore = 0;
997 break;
998 }
999
1000 ifi = NLMSG_DATA(msg);
1001 if (ifi->ifi_index == ifindex) {
1002 struct rtattr *rta = IFLA_RTA(ifi);
1003 int attr_len =
1004 msg->nlmsg_len - NLMSG_LENGTH(sizeof(*ifi));
1005 res = 0;
1006 while (RTA_OK(rta, attr_len)) {
1007 /* Found a local address for the
1008 * requested interface, return it.
1009 */
1010 if (rta->rta_type == IFLA_MTU) {
1011 memcpy(&res, RTA_DATA(rta),
1012 sizeof(int));
1013 err = res;
1014 goto out;
1015 }
1016 rta = RTA_NEXT(rta, attr_len);
1017 }
1018 }
1019
1020 /* Keep reading more data from the socket if the last
1021 * message had the NLF_F_MULTI flag set.
1022 */
1023 readmore = (msg->nlmsg_flags & NLM_F_MULTI);
1024
1025 /* Look at the next message received in this buffer. */
1026 msg = NLMSG_NEXT(msg, recv_len);
1027 }
1028 } while (readmore);
1029
1030 #pragma GCC diagnostic pop
1031
1032 /* If we end up here, we didn't find any result, so signal an error. */
1033 err = -1;
1034
1035 out:
1036 netlink_close(&nlh);
1037 nlmsg_free(answer);
1038 nlmsg_free(nlmsg);
1039 return err;
1040 }
1041
1042 int lxc_netdev_set_mtu(const char *name, int mtu)
1043 {
1044 int err, index, len;
1045 struct ifinfomsg *ifi;
1046 struct nl_handler nlh;
1047 struct nlmsg *answer = NULL, *nlmsg = NULL;
1048
1049 err = netlink_open(&nlh, NETLINK_ROUTE);
1050 if (err)
1051 return err;
1052
1053 err = -EINVAL;
1054 len = strlen(name);
1055 if (len == 1 || len >= IFNAMSIZ)
1056 goto out;
1057
1058 err = -ENOMEM;
1059 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
1060 if (!nlmsg)
1061 goto out;
1062
1063 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
1064 if (!answer)
1065 goto out;
1066
1067 err = -EINVAL;
1068 index = if_nametoindex(name);
1069 if (!index)
1070 goto out;
1071
1072 nlmsg->nlmsghdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
1073 nlmsg->nlmsghdr->nlmsg_type = RTM_NEWLINK;
1074
1075 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
1076 if (!ifi) {
1077 err = -ENOMEM;
1078 goto out;
1079 }
1080 ifi->ifi_family = AF_UNSPEC;
1081 ifi->ifi_index = index;
1082
1083 if (nla_put_u32(nlmsg, IFLA_MTU, mtu))
1084 goto out;
1085
1086 err = netlink_transaction(&nlh, nlmsg, answer);
1087 out:
1088 netlink_close(&nlh);
1089 nlmsg_free(nlmsg);
1090 nlmsg_free(answer);
1091 return err;
1092 }
1093
1094 int lxc_netdev_up(const char *name)
1095 {
1096 return netdev_set_flag(name, IFF_UP);
1097 }
1098
1099 int lxc_netdev_down(const char *name)
1100 {
1101 return netdev_set_flag(name, 0);
1102 }
1103
1104 int lxc_veth_create(const char *name1, const char *name2)
1105 {
1106 int err, len;
1107 struct ifinfomsg *ifi;
1108 struct nl_handler nlh;
1109 struct rtattr *nest1, *nest2, *nest3;
1110 struct nlmsg *answer = NULL, *nlmsg = NULL;
1111
1112 err = netlink_open(&nlh, NETLINK_ROUTE);
1113 if (err)
1114 return err;
1115
1116 err = -EINVAL;
1117 len = strlen(name1);
1118 if (len == 1 || len >= IFNAMSIZ)
1119 goto out;
1120
1121 len = strlen(name2);
1122 if (len == 1 || len >= IFNAMSIZ)
1123 goto out;
1124
1125 err = -ENOMEM;
1126 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
1127 if (!nlmsg)
1128 goto out;
1129
1130 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
1131 if (!answer)
1132 goto out;
1133
1134 nlmsg->nlmsghdr->nlmsg_flags =
1135 NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL | NLM_F_ACK;
1136 nlmsg->nlmsghdr->nlmsg_type = RTM_NEWLINK;
1137
1138 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
1139 if (!ifi)
1140 goto out;
1141 ifi->ifi_family = AF_UNSPEC;
1142
1143 err = -EINVAL;
1144 nest1 = nla_begin_nested(nlmsg, IFLA_LINKINFO);
1145 if (!nest1)
1146 goto out;
1147
1148 if (nla_put_string(nlmsg, IFLA_INFO_KIND, "veth"))
1149 goto out;
1150
1151 nest2 = nla_begin_nested(nlmsg, IFLA_INFO_DATA);
1152 if (!nest2)
1153 goto out;
1154
1155 nest3 = nla_begin_nested(nlmsg, VETH_INFO_PEER);
1156 if (!nest3)
1157 goto out;
1158
1159 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
1160 if (!ifi) {
1161 err = -ENOMEM;
1162 goto out;
1163 }
1164
1165 if (nla_put_string(nlmsg, IFLA_IFNAME, name2))
1166 goto out;
1167
1168 nla_end_nested(nlmsg, nest3);
1169 nla_end_nested(nlmsg, nest2);
1170 nla_end_nested(nlmsg, nest1);
1171
1172 if (nla_put_string(nlmsg, IFLA_IFNAME, name1))
1173 goto out;
1174
1175 err = netlink_transaction(&nlh, nlmsg, answer);
1176 out:
1177 netlink_close(&nlh);
1178 nlmsg_free(answer);
1179 nlmsg_free(nlmsg);
1180 return err;
1181 }
1182
1183 /* TODO: merge with lxc_macvlan_create */
1184 int lxc_vlan_create(const char *master, const char *name, unsigned short vlanid)
1185 {
1186 int err, len, lindex;
1187 struct ifinfomsg *ifi;
1188 struct nl_handler nlh;
1189 struct rtattr *nest, *nest2;
1190 struct nlmsg *answer = NULL, *nlmsg = NULL;
1191
1192 err = netlink_open(&nlh, NETLINK_ROUTE);
1193 if (err)
1194 return err;
1195
1196 err = -EINVAL;
1197 len = strlen(master);
1198 if (len == 1 || len >= IFNAMSIZ)
1199 goto err3;
1200
1201 len = strlen(name);
1202 if (len == 1 || len >= IFNAMSIZ)
1203 goto err3;
1204
1205 err = -ENOMEM;
1206 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
1207 if (!nlmsg)
1208 goto err3;
1209
1210 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
1211 if (!answer)
1212 goto err2;
1213
1214 err = -EINVAL;
1215 lindex = if_nametoindex(master);
1216 if (!lindex)
1217 goto err1;
1218
1219 nlmsg->nlmsghdr->nlmsg_flags =
1220 NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL | NLM_F_ACK;
1221 nlmsg->nlmsghdr->nlmsg_type = RTM_NEWLINK;
1222
1223 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
1224 if (!ifi) {
1225 err = -ENOMEM;
1226 goto err1;
1227 }
1228 ifi->ifi_family = AF_UNSPEC;
1229
1230 nest = nla_begin_nested(nlmsg, IFLA_LINKINFO);
1231 if (!nest)
1232 goto err1;
1233
1234 if (nla_put_string(nlmsg, IFLA_INFO_KIND, "vlan"))
1235 goto err1;
1236
1237 nest2 = nla_begin_nested(nlmsg, IFLA_INFO_DATA);
1238 if (!nest2)
1239 goto err1;
1240
1241 if (nla_put_u16(nlmsg, IFLA_VLAN_ID, vlanid))
1242 goto err1;
1243
1244 nla_end_nested(nlmsg, nest2);
1245 nla_end_nested(nlmsg, nest);
1246
1247 if (nla_put_u32(nlmsg, IFLA_LINK, lindex))
1248 goto err1;
1249
1250 if (nla_put_string(nlmsg, IFLA_IFNAME, name))
1251 goto err1;
1252
1253 err = netlink_transaction(&nlh, nlmsg, answer);
1254 err1:
1255 nlmsg_free(answer);
1256 err2:
1257 nlmsg_free(nlmsg);
1258 err3:
1259 netlink_close(&nlh);
1260 return err;
1261 }
1262
1263 int lxc_macvlan_create(const char *master, const char *name, int mode)
1264 {
1265 int err, index, len;
1266 struct ifinfomsg *ifi;
1267 struct nl_handler nlh;
1268 struct rtattr *nest, *nest2;
1269 struct nlmsg *answer = NULL, *nlmsg = NULL;
1270
1271 err = netlink_open(&nlh, NETLINK_ROUTE);
1272 if (err)
1273 return err;
1274
1275 err = -EINVAL;
1276 len = strlen(master);
1277 if (len == 1 || len >= IFNAMSIZ)
1278 goto out;
1279
1280 len = strlen(name);
1281 if (len == 1 || len >= IFNAMSIZ)
1282 goto out;
1283
1284 err = -ENOMEM;
1285 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
1286 if (!nlmsg)
1287 goto out;
1288
1289 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
1290 if (!answer)
1291 goto out;
1292
1293 err = -EINVAL;
1294 index = if_nametoindex(master);
1295 if (!index)
1296 goto out;
1297
1298 nlmsg->nlmsghdr->nlmsg_flags =
1299 NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL | NLM_F_ACK;
1300 nlmsg->nlmsghdr->nlmsg_type = RTM_NEWLINK;
1301
1302 ifi = nlmsg_reserve(nlmsg, sizeof(struct ifinfomsg));
1303 if (!ifi) {
1304 err = -ENOMEM;
1305 goto out;
1306 }
1307 ifi->ifi_family = AF_UNSPEC;
1308
1309 nest = nla_begin_nested(nlmsg, IFLA_LINKINFO);
1310 if (!nest)
1311 goto out;
1312
1313 if (nla_put_string(nlmsg, IFLA_INFO_KIND, "macvlan"))
1314 goto out;
1315
1316 if (mode) {
1317 nest2 = nla_begin_nested(nlmsg, IFLA_INFO_DATA);
1318 if (!nest2)
1319 goto out;
1320
1321 if (nla_put_u32(nlmsg, IFLA_MACVLAN_MODE, mode))
1322 goto out;
1323
1324 nla_end_nested(nlmsg, nest2);
1325 }
1326
1327 nla_end_nested(nlmsg, nest);
1328
1329 if (nla_put_u32(nlmsg, IFLA_LINK, index))
1330 goto out;
1331
1332 if (nla_put_string(nlmsg, IFLA_IFNAME, name))
1333 goto out;
1334
1335 err = netlink_transaction(&nlh, nlmsg, answer);
1336 out:
1337 netlink_close(&nlh);
1338 nlmsg_free(answer);
1339 nlmsg_free(nlmsg);
1340 return err;
1341 }
1342
1343 static int proc_sys_net_write(const char *path, const char *value)
1344 {
1345 int fd;
1346 int err = 0;
1347
1348 fd = open(path, O_WRONLY);
1349 if (fd < 0)
1350 return -errno;
1351
1352 if (lxc_write_nointr(fd, value, strlen(value)) < 0)
1353 err = -errno;
1354
1355 close(fd);
1356 return err;
1357 }
1358
1359 static int neigh_proxy_set(const char *ifname, int family, int flag)
1360 {
1361 int ret;
1362 char path[PATH_MAX];
1363
1364 if (family != AF_INET && family != AF_INET6)
1365 return -EINVAL;
1366
1367 ret = snprintf(path, PATH_MAX, "/proc/sys/net/%s/conf/%s/%s",
1368 family == AF_INET ? "ipv4" : "ipv6", ifname,
1369 family == AF_INET ? "proxy_arp" : "proxy_ndp");
1370 if (ret < 0 || (size_t)ret >= PATH_MAX)
1371 return -E2BIG;
1372
1373 return proc_sys_net_write(path, flag ? "1" : "0");
1374 }
1375
1376 int lxc_neigh_proxy_on(const char *name, int family)
1377 {
1378 return neigh_proxy_set(name, family, 1);
1379 }
1380
1381 int lxc_neigh_proxy_off(const char *name, int family)
1382 {
1383 return neigh_proxy_set(name, family, 0);
1384 }
1385
1386 int lxc_convert_mac(char *macaddr, struct sockaddr *sockaddr)
1387 {
1388 int i = 0;
1389 unsigned val;
1390 char c;
1391 unsigned char *data;
1392
1393 sockaddr->sa_family = ARPHRD_ETHER;
1394 data = (unsigned char *)sockaddr->sa_data;
1395
1396 while ((*macaddr != '\0') && (i < ETH_ALEN)) {
1397 c = *macaddr++;
1398 if (isdigit(c))
1399 val = c - '0';
1400 else if (c >= 'a' && c <= 'f')
1401 val = c - 'a' + 10;
1402 else if (c >= 'A' && c <= 'F')
1403 val = c - 'A' + 10;
1404 else
1405 return -EINVAL;
1406
1407 val <<= 4;
1408 c = *macaddr;
1409 if (isdigit(c))
1410 val |= c - '0';
1411 else if (c >= 'a' && c <= 'f')
1412 val |= c - 'a' + 10;
1413 else if (c >= 'A' && c <= 'F')
1414 val |= c - 'A' + 10;
1415 else if (c == ':' || c == 0)
1416 val >>= 4;
1417 else
1418 return -EINVAL;
1419 if (c != 0)
1420 macaddr++;
1421 *data++ = (unsigned char)(val & 0377);
1422 i++;
1423
1424 if (*macaddr == ':')
1425 macaddr++;
1426 }
1427
1428 return 0;
1429 }
1430
1431 static int ip_addr_add(int family, int ifindex, void *addr, void *bcast,
1432 void *acast, int prefix)
1433 {
1434 int addrlen, err;
1435 struct ifaddrmsg *ifa;
1436 struct nl_handler nlh;
1437 struct nlmsg *answer = NULL, *nlmsg = NULL;
1438
1439 addrlen = family == AF_INET ? sizeof(struct in_addr)
1440 : sizeof(struct in6_addr);
1441
1442 err = netlink_open(&nlh, NETLINK_ROUTE);
1443 if (err)
1444 return err;
1445
1446 err = -ENOMEM;
1447 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
1448 if (!nlmsg)
1449 goto out;
1450
1451 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
1452 if (!answer)
1453 goto out;
1454
1455 nlmsg->nlmsghdr->nlmsg_flags =
1456 NLM_F_ACK | NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL;
1457 nlmsg->nlmsghdr->nlmsg_type = RTM_NEWADDR;
1458
1459 ifa = nlmsg_reserve(nlmsg, sizeof(struct ifaddrmsg));
1460 if (!ifa)
1461 goto out;
1462 ifa->ifa_prefixlen = prefix;
1463 ifa->ifa_index = ifindex;
1464 ifa->ifa_family = family;
1465 ifa->ifa_scope = 0;
1466
1467 err = -EINVAL;
1468 if (nla_put_buffer(nlmsg, IFA_LOCAL, addr, addrlen))
1469 goto out;
1470
1471 if (nla_put_buffer(nlmsg, IFA_ADDRESS, addr, addrlen))
1472 goto out;
1473
1474 if (nla_put_buffer(nlmsg, IFA_BROADCAST, bcast, addrlen))
1475 goto out;
1476
1477 /* TODO: multicast, anycast with ipv6 */
1478 err = -EPROTONOSUPPORT;
1479 if (family == AF_INET6 &&
1480 (memcmp(bcast, &in6addr_any, sizeof(in6addr_any)) ||
1481 memcmp(acast, &in6addr_any, sizeof(in6addr_any))))
1482 goto out;
1483
1484 err = netlink_transaction(&nlh, nlmsg, answer);
1485 out:
1486 netlink_close(&nlh);
1487 nlmsg_free(answer);
1488 nlmsg_free(nlmsg);
1489 return err;
1490 }
1491
1492 int lxc_ipv6_addr_add(int ifindex, struct in6_addr *addr,
1493 struct in6_addr *mcast, struct in6_addr *acast,
1494 int prefix)
1495 {
1496 return ip_addr_add(AF_INET6, ifindex, addr, mcast, acast, prefix);
1497 }
1498
1499 int lxc_ipv4_addr_add(int ifindex, struct in_addr *addr, struct in_addr *bcast,
1500 int prefix)
1501 {
1502 return ip_addr_add(AF_INET, ifindex, addr, bcast, NULL, prefix);
1503 }
1504
1505 /* Find an IFA_LOCAL (or IFA_ADDRESS if not IFA_LOCAL is present) address from
1506 * the given RTM_NEWADDR message. Allocates memory for the address and stores
1507 * that pointer in *res (so res should be an in_addr** or in6_addr**).
1508 */
1509 #pragma GCC diagnostic push
1510 #pragma GCC diagnostic ignored "-Wcast-align"
1511
1512 static int ifa_get_local_ip(int family, struct nlmsghdr *msg, void **res)
1513 {
1514 int addrlen;
1515 struct ifaddrmsg *ifa = NLMSG_DATA(msg);
1516 struct rtattr *rta = IFA_RTA(ifa);
1517 int attr_len = NLMSG_PAYLOAD(msg, sizeof(struct ifaddrmsg));
1518
1519 if (ifa->ifa_family != family)
1520 return 0;
1521
1522 addrlen = family == AF_INET ? sizeof(struct in_addr)
1523 : sizeof(struct in6_addr);
1524
1525 /* Loop over the rtattr's in this message */
1526 while (RTA_OK(rta, attr_len)) {
1527 /* Found a local address for the requested interface,
1528 * return it.
1529 */
1530 if (rta->rta_type == IFA_LOCAL ||
1531 rta->rta_type == IFA_ADDRESS) {
1532 /* Sanity check. The family check above should make sure
1533 * the address length is correct, but check here just in
1534 * case.
1535 */
1536 if (RTA_PAYLOAD(rta) != addrlen)
1537 return -1;
1538
1539 /* We might have found an IFA_ADDRESS before, which we
1540 * now overwrite with an IFA_LOCAL.
1541 */
1542 if (!*res) {
1543 *res = malloc(addrlen);
1544 if (!*res)
1545 return -1;
1546 }
1547
1548 memcpy(*res, RTA_DATA(rta), addrlen);
1549 if (rta->rta_type == IFA_LOCAL)
1550 break;
1551 }
1552 rta = RTA_NEXT(rta, attr_len);
1553 }
1554 return 0;
1555 }
1556
1557 #pragma GCC diagnostic pop
1558
1559 static int ip_addr_get(int family, int ifindex, void **res)
1560 {
1561 int answer_len, err;
1562 struct ifaddrmsg *ifa;
1563 struct nl_handler nlh;
1564 struct nlmsghdr *msg;
1565 int readmore = 0, recv_len = 0;
1566 struct nlmsg *answer = NULL, *nlmsg = NULL;
1567
1568 err = netlink_open(&nlh, NETLINK_ROUTE);
1569 if (err)
1570 return err;
1571
1572 err = -ENOMEM;
1573 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
1574 if (!nlmsg)
1575 goto out;
1576
1577 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
1578 if (!answer)
1579 goto out;
1580
1581 /* Save the answer buffer length, since it will be overwritten on the
1582 * first receive (and we might need to receive more than once).
1583 */
1584 answer_len = answer->nlmsghdr->nlmsg_len;
1585
1586 nlmsg->nlmsghdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ROOT;
1587 nlmsg->nlmsghdr->nlmsg_type = RTM_GETADDR;
1588
1589 ifa = nlmsg_reserve(nlmsg, sizeof(struct ifaddrmsg));
1590 if (!ifa)
1591 goto out;
1592 ifa->ifa_family = family;
1593
1594 /* Send the request for addresses, which returns all addresses on all
1595 * interfaces.
1596 */
1597 err = netlink_send(&nlh, nlmsg);
1598 if (err < 0)
1599 goto out;
1600
1601 #pragma GCC diagnostic push
1602 #pragma GCC diagnostic ignored "-Wcast-align"
1603
1604 do {
1605 /* Restore the answer buffer length, it might have been
1606 * overwritten by a previous receive.
1607 */
1608 answer->nlmsghdr->nlmsg_len = answer_len;
1609
1610 /* Get the (next) batch of reply messages. */
1611 err = netlink_rcv(&nlh, answer);
1612 if (err < 0)
1613 goto out;
1614
1615 recv_len = err;
1616 err = 0;
1617
1618 /* Satisfy the typing for the netlink macros. */
1619 msg = answer->nlmsghdr;
1620
1621 while (NLMSG_OK(msg, recv_len)) {
1622 /* Stop reading if we see an error message. */
1623 if (msg->nlmsg_type == NLMSG_ERROR) {
1624 struct nlmsgerr *errmsg =
1625 (struct nlmsgerr *)NLMSG_DATA(msg);
1626 err = errmsg->error;
1627 goto out;
1628 }
1629
1630 /* Stop reading if we see a NLMSG_DONE message. */
1631 if (msg->nlmsg_type == NLMSG_DONE) {
1632 readmore = 0;
1633 break;
1634 }
1635
1636 if (msg->nlmsg_type != RTM_NEWADDR) {
1637 err = -1;
1638 goto out;
1639 }
1640
1641 ifa = (struct ifaddrmsg *)NLMSG_DATA(msg);
1642 if (ifa->ifa_index == ifindex) {
1643 if (ifa_get_local_ip(family, msg, res) < 0) {
1644 err = -1;
1645 goto out;
1646 }
1647
1648 /* Found a result, stop searching. */
1649 if (*res)
1650 goto out;
1651 }
1652
1653 /* Keep reading more data from the socket if the last
1654 * message had the NLF_F_MULTI flag set.
1655 */
1656 readmore = (msg->nlmsg_flags & NLM_F_MULTI);
1657
1658 /* Look at the next message received in this buffer. */
1659 msg = NLMSG_NEXT(msg, recv_len);
1660 }
1661 } while (readmore);
1662
1663 #pragma GCC diagnostic pop
1664
1665 /* If we end up here, we didn't find any result, so signal an
1666 * error.
1667 */
1668 err = -1;
1669
1670 out:
1671 netlink_close(&nlh);
1672 nlmsg_free(answer);
1673 nlmsg_free(nlmsg);
1674 return err;
1675 }
1676
1677 int lxc_ipv6_addr_get(int ifindex, struct in6_addr **res)
1678 {
1679 return ip_addr_get(AF_INET6, ifindex, (void **)res);
1680 }
1681
1682 int lxc_ipv4_addr_get(int ifindex, struct in_addr **res)
1683 {
1684 return ip_addr_get(AF_INET, ifindex, (void **)res);
1685 }
1686
1687 static int ip_gateway_add(int family, int ifindex, void *gw)
1688 {
1689 int addrlen, err;
1690 struct nl_handler nlh;
1691 struct rtmsg *rt;
1692 struct nlmsg *answer = NULL, *nlmsg = NULL;
1693
1694 addrlen = family == AF_INET ? sizeof(struct in_addr)
1695 : sizeof(struct in6_addr);
1696
1697 err = netlink_open(&nlh, NETLINK_ROUTE);
1698 if (err)
1699 return err;
1700
1701 err = -ENOMEM;
1702 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
1703 if (!nlmsg)
1704 goto out;
1705
1706 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
1707 if (!answer)
1708 goto out;
1709
1710 nlmsg->nlmsghdr->nlmsg_flags =
1711 NLM_F_ACK | NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL;
1712 nlmsg->nlmsghdr->nlmsg_type = RTM_NEWROUTE;
1713
1714 rt = nlmsg_reserve(nlmsg, sizeof(struct rtmsg));
1715 if (!rt)
1716 goto out;
1717 rt->rtm_family = family;
1718 rt->rtm_table = RT_TABLE_MAIN;
1719 rt->rtm_scope = RT_SCOPE_UNIVERSE;
1720 rt->rtm_protocol = RTPROT_BOOT;
1721 rt->rtm_type = RTN_UNICAST;
1722 /* "default" destination */
1723 rt->rtm_dst_len = 0;
1724
1725 err = -EINVAL;
1726 if (nla_put_buffer(nlmsg, RTA_GATEWAY, gw, addrlen))
1727 goto out;
1728
1729 /* Adding the interface index enables the use of link-local
1730 * addresses for the gateway.
1731 */
1732 if (nla_put_u32(nlmsg, RTA_OIF, ifindex))
1733 goto out;
1734
1735 err = netlink_transaction(&nlh, nlmsg, answer);
1736 out:
1737 netlink_close(&nlh);
1738 nlmsg_free(answer);
1739 nlmsg_free(nlmsg);
1740 return err;
1741 }
1742
1743 int lxc_ipv4_gateway_add(int ifindex, struct in_addr *gw)
1744 {
1745 return ip_gateway_add(AF_INET, ifindex, gw);
1746 }
1747
1748 int lxc_ipv6_gateway_add(int ifindex, struct in6_addr *gw)
1749 {
1750 return ip_gateway_add(AF_INET6, ifindex, gw);
1751 }
1752
1753 static int ip_route_dest_add(int family, int ifindex, void *dest)
1754 {
1755 int addrlen, err;
1756 struct nl_handler nlh;
1757 struct rtmsg *rt;
1758 struct nlmsg *answer = NULL, *nlmsg = NULL;
1759
1760 addrlen = family == AF_INET ? sizeof(struct in_addr)
1761 : sizeof(struct in6_addr);
1762
1763 err = netlink_open(&nlh, NETLINK_ROUTE);
1764 if (err)
1765 return err;
1766
1767 err = -ENOMEM;
1768 nlmsg = nlmsg_alloc(NLMSG_GOOD_SIZE);
1769 if (!nlmsg)
1770 goto out;
1771
1772 answer = nlmsg_alloc_reserve(NLMSG_GOOD_SIZE);
1773 if (!answer)
1774 goto out;
1775
1776 nlmsg->nlmsghdr->nlmsg_flags =
1777 NLM_F_ACK | NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL;
1778 nlmsg->nlmsghdr->nlmsg_type = RTM_NEWROUTE;
1779
1780 rt = nlmsg_reserve(nlmsg, sizeof(struct rtmsg));
1781 if (!rt)
1782 goto out;
1783 rt->rtm_family = family;
1784 rt->rtm_table = RT_TABLE_MAIN;
1785 rt->rtm_scope = RT_SCOPE_LINK;
1786 rt->rtm_protocol = RTPROT_BOOT;
1787 rt->rtm_type = RTN_UNICAST;
1788 rt->rtm_dst_len = addrlen * 8;
1789
1790 err = -EINVAL;
1791 if (nla_put_buffer(nlmsg, RTA_DST, dest, addrlen))
1792 goto out;
1793 if (nla_put_u32(nlmsg, RTA_OIF, ifindex))
1794 goto out;
1795 err = netlink_transaction(&nlh, nlmsg, answer);
1796 out:
1797 netlink_close(&nlh);
1798 nlmsg_free(answer);
1799 nlmsg_free(nlmsg);
1800 return err;
1801 }
1802
1803 int lxc_ipv4_dest_add(int ifindex, struct in_addr *dest)
1804 {
1805 return ip_route_dest_add(AF_INET, ifindex, dest);
1806 }
1807
1808 int lxc_ipv6_dest_add(int ifindex, struct in6_addr *dest)
1809 {
1810 return ip_route_dest_add(AF_INET6, ifindex, dest);
1811 }
1812
1813 bool is_ovs_bridge(const char *bridge)
1814 {
1815 int ret;
1816 struct stat sb;
1817 char brdirname[22 + IFNAMSIZ + 1] = {0};
1818
1819 ret = snprintf(brdirname, 22 + IFNAMSIZ + 1, "/sys/class/net/%s/bridge",
1820 bridge);
1821 if (ret < 0 || (size_t)ret >= 22 + IFNAMSIZ + 1)
1822 return false;
1823
1824 ret = stat(brdirname, &sb);
1825 if (ret < 0 && errno == ENOENT)
1826 return true;
1827
1828 return false;
1829 }
1830
1831 struct ovs_veth_args {
1832 const char *bridge;
1833 const char *nic;
1834 };
1835
1836 /* Called from a background thread - when nic goes away, remove it from the
1837 * bridge.
1838 */
1839 static int lxc_ovs_delete_port_exec(void *data)
1840 {
1841 struct ovs_veth_args *args = data;
1842
1843 execlp("ovs-vsctl", "ovs-vsctl", "del-port", args->bridge, args->nic,
1844 (char *)NULL);
1845 return -1;
1846 }
1847
1848 int lxc_ovs_delete_port(const char *bridge, const char *nic)
1849 {
1850 int ret;
1851 char cmd_output[PATH_MAX];
1852 struct ovs_veth_args args;
1853
1854 args.bridge = bridge;
1855 args.nic = nic;
1856 ret = run_command(cmd_output, sizeof(cmd_output),
1857 lxc_ovs_delete_port_exec, (void *)&args);
1858 if (ret < 0) {
1859 ERROR("Failed to delete \"%s\" from openvswitch bridge \"%s\": "
1860 "%s", bridge, nic, cmd_output);
1861 return -1;
1862 }
1863
1864 return 0;
1865 }
1866
1867 static int lxc_ovs_attach_bridge_exec(void *data)
1868 {
1869 struct ovs_veth_args *args = data;
1870
1871 execlp("ovs-vsctl", "ovs-vsctl", "add-port", args->bridge, args->nic,
1872 (char *)NULL);
1873 return -1;
1874 }
1875
1876 static int lxc_ovs_attach_bridge(const char *bridge, const char *nic)
1877 {
1878 int ret;
1879 char cmd_output[PATH_MAX];
1880 struct ovs_veth_args args;
1881
1882 args.bridge = bridge;
1883 args.nic = nic;
1884 ret = run_command(cmd_output, sizeof(cmd_output),
1885 lxc_ovs_attach_bridge_exec, (void *)&args);
1886 if (ret < 0) {
1887 ERROR("Failed to attach \"%s\" to openvswitch bridge \"%s\": %s",
1888 bridge, nic, cmd_output);
1889 return -1;
1890 }
1891
1892 return 0;
1893 }
1894
1895 int lxc_bridge_attach(const char *bridge, const char *ifname)
1896 {
1897 int err, fd, index;
1898 size_t retlen;
1899 struct ifreq ifr;
1900
1901 if (strlen(ifname) >= IFNAMSIZ)
1902 return -EINVAL;
1903
1904 index = if_nametoindex(ifname);
1905 if (!index)
1906 return -EINVAL;
1907
1908 if (is_ovs_bridge(bridge))
1909 return lxc_ovs_attach_bridge(bridge, ifname);
1910
1911 fd = socket(AF_INET, SOCK_STREAM, 0);
1912 if (fd < 0)
1913 return -errno;
1914
1915 retlen = strlcpy(ifr.ifr_name, bridge, IFNAMSIZ);
1916 if (retlen >= IFNAMSIZ) {
1917 close(fd);
1918 return -E2BIG;
1919 }
1920
1921 ifr.ifr_name[IFNAMSIZ - 1] = '\0';
1922 ifr.ifr_ifindex = index;
1923 err = ioctl(fd, SIOCBRADDIF, &ifr);
1924 close(fd);
1925 if (err)
1926 err = -errno;
1927
1928 return err;
1929 }
1930
1931 static const char *const lxc_network_types[LXC_NET_MAXCONFTYPE + 1] = {
1932 [LXC_NET_EMPTY] = "empty",
1933 [LXC_NET_VETH] = "veth",
1934 [LXC_NET_MACVLAN] = "macvlan",
1935 [LXC_NET_PHYS] = "phys",
1936 [LXC_NET_VLAN] = "vlan",
1937 [LXC_NET_NONE] = "none",
1938 };
1939
1940 const char *lxc_net_type_to_str(int type)
1941 {
1942 if (type < 0 || type > LXC_NET_MAXCONFTYPE)
1943 return NULL;
1944
1945 return lxc_network_types[type];
1946 }
1947
1948 static const char padchar[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
1949
1950 char *lxc_mkifname(char *template)
1951 {
1952 int ret;
1953 struct netns_ifaddrs *ifa, *ifaddr;
1954 char name[IFNAMSIZ];
1955 bool exists = false;
1956 size_t i = 0;
1957 #ifdef HAVE_RAND_R
1958 unsigned int seed;
1959
1960 seed = randseed(false);
1961 #else
1962
1963 (void)randseed(true);
1964 #endif
1965
1966 if (strlen(template) >= IFNAMSIZ)
1967 return NULL;
1968
1969 /* Get all the network interfaces. */
1970 ret = netns_getifaddrs(&ifaddr, -1, &(bool){false});
1971 if (ret < 0) {
1972 SYSERROR("Failed to get network interfaces");
1973 return NULL;
1974 }
1975
1976 /* Generate random names until we find one that doesn't exist. */
1977 while (true) {
1978 name[0] = '\0';
1979 (void)strlcpy(name, template, IFNAMSIZ);
1980
1981 exists = false;
1982
1983 for (i = 0; i < strlen(name); i++) {
1984 if (name[i] == 'X') {
1985 #ifdef HAVE_RAND_R
1986 name[i] = padchar[rand_r(&seed) % strlen(padchar)];
1987 #else
1988 name[i] = padchar[rand() % strlen(padchar)];
1989 #endif
1990 }
1991 }
1992
1993 for (ifa = ifaddr; ifa != NULL; ifa = ifa->ifa_next) {
1994 if (!strcmp(ifa->ifa_name, name)) {
1995 exists = true;
1996 break;
1997 }
1998 }
1999
2000 if (!exists)
2001 break;
2002 }
2003
2004 netns_freeifaddrs(ifaddr);
2005 (void)strlcpy(template, name, strlen(template) + 1);
2006
2007 return template;
2008 }
2009
2010 int setup_private_host_hw_addr(char *veth1)
2011 {
2012 int err, sockfd;
2013 struct ifreq ifr;
2014
2015 sockfd = socket(AF_INET, SOCK_DGRAM, 0);
2016 if (sockfd < 0)
2017 return -errno;
2018
2019 err = snprintf((char *)ifr.ifr_name, IFNAMSIZ, "%s", veth1);
2020 if (err < 0 || (size_t)err >= IFNAMSIZ) {
2021 close(sockfd);
2022 return -E2BIG;
2023 }
2024
2025 err = ioctl(sockfd, SIOCGIFHWADDR, &ifr);
2026 if (err < 0) {
2027 close(sockfd);
2028 return -errno;
2029 }
2030
2031 ifr.ifr_hwaddr.sa_data[0] = 0xfe;
2032 err = ioctl(sockfd, SIOCSIFHWADDR, &ifr);
2033 close(sockfd);
2034 if (err < 0)
2035 return -errno;
2036
2037 return 0;
2038 }
2039
2040 int lxc_find_gateway_addresses(struct lxc_handler *handler)
2041 {
2042 struct lxc_list *network = &handler->conf->network;
2043 struct lxc_list *iterator;
2044 struct lxc_netdev *netdev;
2045 int link_index;
2046
2047 lxc_list_for_each(iterator, network) {
2048 netdev = iterator->elem;
2049
2050 if (!netdev->ipv4_gateway_auto && !netdev->ipv6_gateway_auto)
2051 continue;
2052
2053 if (netdev->type != LXC_NET_VETH && netdev->type != LXC_NET_MACVLAN) {
2054 ERROR("Automatic gateway detection is only supported "
2055 "for veth and macvlan");
2056 return -1;
2057 }
2058
2059 if (netdev->link[0] == '\0') {
2060 ERROR("Automatic gateway detection needs a link interface");
2061 return -1;
2062 }
2063
2064 link_index = if_nametoindex(netdev->link);
2065 if (!link_index)
2066 return -EINVAL;
2067
2068 if (netdev->ipv4_gateway_auto) {
2069 if (lxc_ipv4_addr_get(link_index, &netdev->ipv4_gateway)) {
2070 ERROR("Failed to automatically find ipv4 gateway "
2071 "address from link interface \"%s\"", netdev->link);
2072 return -1;
2073 }
2074 }
2075
2076 if (netdev->ipv6_gateway_auto) {
2077 if (lxc_ipv6_addr_get(link_index, &netdev->ipv6_gateway)) {
2078 ERROR("Failed to automatically find ipv6 gateway "
2079 "address from link interface \"%s\"", netdev->link);
2080 return -1;
2081 }
2082 }
2083 }
2084
2085 return 0;
2086 }
2087
2088 #define LXC_USERNIC_PATH LIBEXECDIR "/lxc/lxc-user-nic"
2089 static int lxc_create_network_unpriv_exec(const char *lxcpath, const char *lxcname,
2090 struct lxc_netdev *netdev, pid_t pid, unsigned int hooks_version)
2091 {
2092 int ret;
2093 pid_t child;
2094 int bytes, pipefd[2];
2095 char *token, *saveptr = NULL;
2096 char netdev_link[IFNAMSIZ];
2097 char buffer[PATH_MAX] = {0};
2098 size_t retlen;
2099
2100 if (netdev->type != LXC_NET_VETH) {
2101 ERROR("Network type %d not support for unprivileged use", netdev->type);
2102 return -1;
2103 }
2104
2105 ret = pipe(pipefd);
2106 if (ret < 0) {
2107 SYSERROR("Failed to create pipe");
2108 return -1;
2109 }
2110
2111 child = fork();
2112 if (child < 0) {
2113 SYSERROR("Failed to create new process");
2114 close(pipefd[0]);
2115 close(pipefd[1]);
2116 return -1;
2117 }
2118
2119 if (child == 0) {
2120 char pidstr[INTTYPE_TO_STRLEN(pid_t)];
2121
2122 close(pipefd[0]);
2123
2124 ret = dup2(pipefd[1], STDOUT_FILENO);
2125 if (ret >= 0)
2126 ret = dup2(pipefd[1], STDERR_FILENO);
2127 close(pipefd[1]);
2128 if (ret < 0) {
2129 SYSERROR("Failed to duplicate std{err,out} file descriptor");
2130 _exit(EXIT_FAILURE);
2131 }
2132
2133 if (netdev->link[0] != '\0')
2134 retlen = strlcpy(netdev_link, netdev->link, IFNAMSIZ);
2135 else
2136 retlen = strlcpy(netdev_link, "none", IFNAMSIZ);
2137 if (retlen >= IFNAMSIZ) {
2138 SYSERROR("Invalid network device name");
2139 _exit(EXIT_FAILURE);
2140 }
2141
2142 ret = snprintf(pidstr, sizeof(pidstr), "%d", pid);
2143 if (ret < 0 || ret >= sizeof(pidstr))
2144 _exit(EXIT_FAILURE);
2145 pidstr[sizeof(pidstr) - 1] = '\0';
2146
2147 INFO("Execing lxc-user-nic create %s %s %s veth %s %s", lxcpath,
2148 lxcname, pidstr, netdev_link,
2149 netdev->name[0] != '\0' ? netdev->name : "(null)");
2150 if (netdev->name[0] != '\0')
2151 execlp(LXC_USERNIC_PATH, LXC_USERNIC_PATH, "create",
2152 lxcpath, lxcname, pidstr, "veth", netdev_link,
2153 netdev->name, (char *)NULL);
2154 else
2155 execlp(LXC_USERNIC_PATH, LXC_USERNIC_PATH, "create",
2156 lxcpath, lxcname, pidstr, "veth", netdev_link,
2157 (char *)NULL);
2158 SYSERROR("Failed to execute lxc-user-nic");
2159 _exit(EXIT_FAILURE);
2160 }
2161
2162 /* close the write-end of the pipe */
2163 close(pipefd[1]);
2164
2165 bytes = lxc_read_nointr(pipefd[0], &buffer, PATH_MAX);
2166 if (bytes < 0) {
2167 SYSERROR("Failed to read from pipe file descriptor");
2168 close(pipefd[0]);
2169 } else {
2170 buffer[bytes - 1] = '\0';
2171 }
2172
2173 ret = wait_for_pid(child);
2174 close(pipefd[0]);
2175 if (ret != 0 || bytes < 0) {
2176 ERROR("lxc-user-nic failed to configure requested network: %s",
2177 buffer[0] != '\0' ? buffer : "(null)");
2178 return -1;
2179 }
2180 TRACE("Received output \"%s\" from lxc-user-nic", buffer);
2181
2182 /* netdev->name */
2183 token = strtok_r(buffer, ":", &saveptr);
2184 if (!token) {
2185 ERROR("Failed to parse lxc-user-nic output");
2186 return -1;
2187 }
2188
2189 memset(netdev->name, 0, IFNAMSIZ);
2190 memcpy(netdev->name, token, IFNAMSIZ - 1);
2191
2192 /* netdev->ifindex */
2193 token = strtok_r(NULL, ":", &saveptr);
2194 if (!token) {
2195 ERROR("Failed to parse lxc-user-nic output");
2196 return -1;
2197 }
2198
2199 ret = lxc_safe_int(token, &netdev->ifindex);
2200 if (ret < 0) {
2201 errno = -ret;
2202 SYSERROR("Failed to convert string \"%s\" to integer", token);
2203 return -1;
2204 }
2205
2206 /* netdev->priv.veth_attr.veth1 */
2207 token = strtok_r(NULL, ":", &saveptr);
2208 if (!token) {
2209 ERROR("Failed to parse lxc-user-nic output");
2210 return -1;
2211 }
2212
2213 retlen = strlcpy(netdev->priv.veth_attr.veth1, token, IFNAMSIZ);
2214 if (retlen >= IFNAMSIZ) {
2215 ERROR("Host side veth device name returned by lxc-user-nic is "
2216 "too long");
2217 return -E2BIG;
2218 }
2219
2220 /* netdev->priv.veth_attr.ifindex */
2221 token = strtok_r(NULL, ":", &saveptr);
2222 if (!token) {
2223 ERROR("Failed to parse lxc-user-nic output");
2224 return -1;
2225 }
2226
2227 ret = lxc_safe_int(token, &netdev->priv.veth_attr.ifindex);
2228 if (ret < 0) {
2229 errno = -ret;
2230 SYSERROR("Failed to convert string \"%s\" to integer", token);
2231 return -1;
2232 }
2233
2234 if (netdev->upscript) {
2235 char *argv[] = {
2236 "veth",
2237 netdev->link,
2238 netdev->priv.veth_attr.veth1,
2239 NULL,
2240 };
2241
2242 ret = run_script_argv(lxcname,
2243 hooks_version, "net",
2244 netdev->upscript, "up", argv);
2245 if (ret < 0)
2246 return -1;
2247 }
2248
2249 return 0;
2250 }
2251
2252 static int lxc_delete_network_unpriv_exec(const char *lxcpath, const char *lxcname,
2253 struct lxc_netdev *netdev,
2254 const char *netns_path)
2255 {
2256 int bytes, ret;
2257 pid_t child;
2258 int pipefd[2];
2259 char buffer[PATH_MAX] = {0};
2260
2261 if (netdev->type != LXC_NET_VETH) {
2262 ERROR("Network type %d not support for unprivileged use", netdev->type);
2263 return -1;
2264 }
2265
2266 ret = pipe(pipefd);
2267 if (ret < 0) {
2268 SYSERROR("Failed to create pipe");
2269 return -1;
2270 }
2271
2272 child = fork();
2273 if (child < 0) {
2274 SYSERROR("Failed to create new process");
2275 close(pipefd[0]);
2276 close(pipefd[1]);
2277 return -1;
2278 }
2279
2280 if (child == 0) {
2281 char *hostveth;
2282
2283 close(pipefd[0]);
2284
2285 ret = dup2(pipefd[1], STDOUT_FILENO);
2286 if (ret >= 0)
2287 ret = dup2(pipefd[1], STDERR_FILENO);
2288 close(pipefd[1]);
2289 if (ret < 0) {
2290 SYSERROR("Failed to duplicate std{err,out} file descriptor");
2291 _exit(EXIT_FAILURE);
2292 }
2293
2294 if (netdev->priv.veth_attr.pair[0] != '\0')
2295 hostveth = netdev->priv.veth_attr.pair;
2296 else
2297 hostveth = netdev->priv.veth_attr.veth1;
2298 if (hostveth[0] == '\0') {
2299 SYSERROR("Host side veth device name is missing");
2300 _exit(EXIT_FAILURE);
2301 }
2302
2303 if (netdev->link[0] == '\0') {
2304 SYSERROR("Network link for network device \"%s\" is "
2305 "missing", netdev->priv.veth_attr.veth1);
2306 _exit(EXIT_FAILURE);
2307 }
2308
2309 INFO("Execing lxc-user-nic delete %s %s %s veth %s %s", lxcpath,
2310 lxcname, netns_path, netdev->link, hostveth);
2311 execlp(LXC_USERNIC_PATH, LXC_USERNIC_PATH, "delete", lxcpath,
2312 lxcname, netns_path, "veth", netdev->link, hostveth,
2313 (char *)NULL);
2314 SYSERROR("Failed to exec lxc-user-nic.");
2315 _exit(EXIT_FAILURE);
2316 }
2317
2318 close(pipefd[1]);
2319
2320 bytes = lxc_read_nointr(pipefd[0], &buffer, PATH_MAX);
2321 if (bytes < 0) {
2322 SYSERROR("Failed to read from pipe file descriptor.");
2323 close(pipefd[0]);
2324 } else {
2325 buffer[bytes - 1] = '\0';
2326 }
2327
2328 ret = wait_for_pid(child);
2329 close(pipefd[0]);
2330 if (ret != 0 || bytes < 0) {
2331 ERROR("lxc-user-nic failed to delete requested network: %s",
2332 buffer[0] != '\0' ? buffer : "(null)");
2333 return -1;
2334 }
2335
2336 return 0;
2337 }
2338
2339 bool lxc_delete_network_unpriv(struct lxc_handler *handler)
2340 {
2341 int ret;
2342 struct lxc_list *iterator;
2343 struct lxc_list *network = &handler->conf->network;
2344 /* strlen("/proc/") = 6
2345 * +
2346 * INTTYPE_TO_STRLEN(pid_t)
2347 * +
2348 * strlen("/fd/") = 4
2349 * +
2350 * INTTYPE_TO_STRLEN(int)
2351 * +
2352 * \0
2353 */
2354 char netns_path[6 + INTTYPE_TO_STRLEN(pid_t) + 4 + INTTYPE_TO_STRLEN(int) + 1];
2355
2356 *netns_path = '\0';
2357
2358 if (handler->nsfd[LXC_NS_NET] < 0) {
2359 DEBUG("Cannot not guarantee safe deletion of network devices. "
2360 "Manual cleanup maybe needed");
2361 return false;
2362 }
2363
2364 ret = snprintf(netns_path, sizeof(netns_path), "/proc/%d/fd/%d",
2365 lxc_raw_getpid(), handler->nsfd[LXC_NS_NET]);
2366 if (ret < 0 || ret >= sizeof(netns_path))
2367 return false;
2368
2369 lxc_list_for_each(iterator, network) {
2370 char *hostveth = NULL;
2371 struct lxc_netdev *netdev = iterator->elem;
2372
2373 /* We can only delete devices whose ifindex we have. If we don't
2374 * have the index it means that we didn't create it.
2375 */
2376 if (!netdev->ifindex)
2377 continue;
2378
2379 if (netdev->type == LXC_NET_PHYS) {
2380 ret = lxc_netdev_rename_by_index(netdev->ifindex,
2381 netdev->link);
2382 if (ret < 0)
2383 WARN("Failed to rename interface with index %d "
2384 "to its initial name \"%s\"",
2385 netdev->ifindex, netdev->link);
2386 else
2387 TRACE("Renamed interface with index %d to its "
2388 "initial name \"%s\"",
2389 netdev->ifindex, netdev->link);
2390 goto clear_ifindices;
2391 }
2392
2393 ret = netdev_deconf[netdev->type](handler, netdev);
2394 if (ret < 0)
2395 WARN("Failed to deconfigure network device");
2396
2397 if (netdev->type != LXC_NET_VETH)
2398 goto clear_ifindices;
2399
2400 if (netdev->link[0] == '\0' || !is_ovs_bridge(netdev->link))
2401 goto clear_ifindices;
2402
2403 if (netdev->priv.veth_attr.pair[0] != '\0')
2404 hostveth = netdev->priv.veth_attr.pair;
2405 else
2406 hostveth = netdev->priv.veth_attr.veth1;
2407 if (hostveth[0] == '\0')
2408 goto clear_ifindices;
2409
2410 ret = lxc_delete_network_unpriv_exec(handler->lxcpath,
2411 handler->name, netdev,
2412 netns_path);
2413 if (ret < 0) {
2414 WARN("Failed to remove port \"%s\" from openvswitch "
2415 "bridge \"%s\"", hostveth, netdev->link);
2416 goto clear_ifindices;
2417 }
2418 INFO("Removed interface \"%s\" from \"%s\"", hostveth,
2419 netdev->link);
2420
2421 clear_ifindices:
2422 /* We need to clear any ifindices we recorded so liblxc won't
2423 * have cached stale data which would cause it to fail on reboot
2424 * we're we don't re-read the on-disk config file.
2425 */
2426 netdev->ifindex = 0;
2427 if (netdev->type == LXC_NET_PHYS) {
2428 netdev->priv.phys_attr.ifindex = 0;
2429 } else if (netdev->type == LXC_NET_VETH) {
2430 netdev->priv.veth_attr.veth1[0] = '\0';
2431 netdev->priv.veth_attr.ifindex = 0;
2432 }
2433 }
2434
2435 return true;
2436 }
2437
2438 int lxc_create_network_priv(struct lxc_handler *handler)
2439 {
2440 struct lxc_list *iterator;
2441 struct lxc_list *network = &handler->conf->network;
2442
2443 if (!handler->am_root)
2444 return 0;
2445
2446 lxc_list_for_each(iterator, network) {
2447 struct lxc_netdev *netdev = iterator->elem;
2448
2449 if (netdev->type < 0 || netdev->type > LXC_NET_MAXCONFTYPE) {
2450 ERROR("Invalid network configuration type %d", netdev->type);
2451 return -1;
2452 }
2453
2454 if (netdev_conf[netdev->type](handler, netdev)) {
2455 ERROR("Failed to create network device");
2456 return -1;
2457 }
2458
2459 }
2460
2461 return 0;
2462 }
2463
2464 int lxc_network_move_created_netdev_priv(const char *lxcpath, const char *lxcname,
2465 struct lxc_list *network, pid_t pid)
2466 {
2467 int ret;
2468 char ifname[IFNAMSIZ];
2469 struct lxc_list *iterator;
2470
2471 if (am_guest_unpriv())
2472 return 0;
2473
2474 lxc_list_for_each(iterator, network) {
2475 struct lxc_netdev *netdev = iterator->elem;
2476
2477 if (!netdev->ifindex)
2478 continue;
2479
2480 /* retrieve the name of the interface */
2481 if (!if_indextoname(netdev->ifindex, ifname)) {
2482 ERROR("No interface corresponding to ifindex \"%d\"",
2483 netdev->ifindex);
2484 return -1;
2485 }
2486
2487 ret = lxc_netdev_move_by_name(ifname, pid, NULL);
2488 if (ret) {
2489 errno = -ret;
2490 SYSERROR("Failed to move network device \"%s\" to "
2491 "network namespace %d", ifname, pid);
2492 return -1;
2493 }
2494
2495 DEBUG("Moved network device \"%s\"/\"%s\" to network namespace "
2496 "of %d",
2497 ifname, netdev->name[0] != '\0' ? netdev->name : "(null)",
2498 pid);
2499 }
2500
2501 return 0;
2502 }
2503
2504 int lxc_create_network_unpriv(const char *lxcpath, const char *lxcname,
2505 struct lxc_list *network, pid_t pid, unsigned int hooks_version)
2506 {
2507 struct lxc_list *iterator;
2508
2509 if (!am_guest_unpriv())
2510 return 0;
2511
2512 lxc_list_for_each(iterator, network) {
2513 struct lxc_netdev *netdev = iterator->elem;
2514
2515 if (netdev->type == LXC_NET_EMPTY)
2516 continue;
2517
2518 if (netdev->type == LXC_NET_NONE)
2519 continue;
2520
2521 if (netdev->type != LXC_NET_VETH) {
2522 ERROR("Networks of type %s are not supported by "
2523 "unprivileged containers",
2524 lxc_net_type_to_str(netdev->type));
2525 return -1;
2526 }
2527
2528 if (netdev->mtu)
2529 INFO("mtu ignored due to insufficient privilege");
2530
2531 if (lxc_create_network_unpriv_exec(lxcpath, lxcname, netdev, pid, hooks_version))
2532 return -1;
2533 }
2534
2535 return 0;
2536 }
2537
2538 bool lxc_delete_network_priv(struct lxc_handler *handler)
2539 {
2540 int ret;
2541 struct lxc_list *iterator;
2542 struct lxc_list *network = &handler->conf->network;
2543
2544 lxc_list_for_each(iterator, network) {
2545 char *hostveth = NULL;
2546 struct lxc_netdev *netdev = iterator->elem;
2547
2548 /* We can only delete devices whose ifindex we have. If we don't
2549 * have the index it means that we didn't create it.
2550 */
2551 if (!netdev->ifindex)
2552 continue;
2553
2554 if (netdev->type == LXC_NET_PHYS) {
2555 ret = lxc_netdev_rename_by_index(netdev->ifindex, netdev->link);
2556 if (ret < 0)
2557 WARN("Failed to rename interface with index %d "
2558 "from \"%s\" to its initial name \"%s\"",
2559 netdev->ifindex, netdev->name, netdev->link);
2560 else
2561 TRACE("Renamed interface with index %d from "
2562 "\"%s\" to its initial name \"%s\"",
2563 netdev->ifindex, netdev->name,
2564 netdev->link);
2565 goto clear_ifindices;
2566 }
2567
2568 ret = netdev_deconf[netdev->type](handler, netdev);
2569 if (ret < 0)
2570 WARN("Failed to deconfigure network device");
2571
2572 /* Recent kernels remove the virtual interfaces when the network
2573 * namespace is destroyed but in case we did not move the
2574 * interface to the network namespace, we have to destroy it.
2575 */
2576 ret = lxc_netdev_delete_by_index(netdev->ifindex);
2577 if (-ret == ENODEV) {
2578 INFO("Interface \"%s\" with index %d already "
2579 "deleted or existing in different network "
2580 "namespace",
2581 netdev->name[0] != '\0' ? netdev->name : "(null)",
2582 netdev->ifindex);
2583 } else if (ret < 0) {
2584 errno = -ret;
2585 SYSWARN("Failed to remove interface \"%s\" with index %d",
2586 netdev->name[0] != '\0' ? netdev->name : "(null)",
2587 netdev->ifindex);
2588 goto clear_ifindices;
2589 }
2590 INFO("Removed interface \"%s\" with index %d",
2591 netdev->name[0] != '\0' ? netdev->name : "(null)",
2592 netdev->ifindex);
2593
2594 if (netdev->type != LXC_NET_VETH)
2595 goto clear_ifindices;
2596
2597 /* Explicitly delete host veth device to prevent lingering
2598 * devices. We had issues in LXD around this.
2599 */
2600 if (netdev->priv.veth_attr.pair[0] != '\0')
2601 hostveth = netdev->priv.veth_attr.pair;
2602 else
2603 hostveth = netdev->priv.veth_attr.veth1;
2604 if (hostveth[0] == '\0')
2605 goto clear_ifindices;
2606
2607 ret = lxc_netdev_delete_by_name(hostveth);
2608 if (ret < 0) {
2609 errno = -ret;
2610 SYSWARN("Failed to remove interface \"%s\" from \"%s\"",
2611 hostveth, netdev->link);
2612 goto clear_ifindices;
2613 }
2614 INFO("Removed interface \"%s\" from \"%s\"", hostveth, netdev->link);
2615
2616 if (netdev->link[0] == '\0' || !is_ovs_bridge(netdev->link)) {
2617 netdev->priv.veth_attr.veth1[0] = '\0';
2618 netdev->ifindex = 0;
2619 netdev->priv.veth_attr.ifindex = 0;
2620 goto clear_ifindices;
2621 }
2622
2623 /* Delete the openvswitch port. */
2624 ret = lxc_ovs_delete_port(netdev->link, hostveth);
2625 if (ret < 0)
2626 WARN("Failed to remove port \"%s\" from openvswitch "
2627 "bridge \"%s\"", hostveth, netdev->link);
2628 else
2629 INFO("Removed port \"%s\" from openvswitch bridge \"%s\"",
2630 hostveth, netdev->link);
2631
2632 clear_ifindices:
2633 /* We need to clear any ifindices we recorded so liblxc won't
2634 * have cached stale data which would cause it to fail on reboot
2635 * we're we don't re-read the on-disk config file.
2636 */
2637 netdev->ifindex = 0;
2638 if (netdev->type == LXC_NET_PHYS) {
2639 netdev->priv.phys_attr.ifindex = 0;
2640 } else if (netdev->type == LXC_NET_VETH) {
2641 netdev->priv.veth_attr.veth1[0] = '\0';
2642 netdev->priv.veth_attr.ifindex = 0;
2643 }
2644 }
2645
2646 return true;
2647 }
2648
2649 int lxc_requests_empty_network(struct lxc_handler *handler)
2650 {
2651 struct lxc_list *network = &handler->conf->network;
2652 struct lxc_list *iterator;
2653 bool found_none = false, found_nic = false;
2654
2655 if (lxc_list_empty(network))
2656 return 0;
2657
2658 lxc_list_for_each(iterator, network) {
2659 struct lxc_netdev *netdev = iterator->elem;
2660
2661 if (netdev->type == LXC_NET_NONE)
2662 found_none = true;
2663 else
2664 found_nic = true;
2665 }
2666 if (found_none && !found_nic)
2667 return 1;
2668 return 0;
2669 }
2670
2671 /* try to move physical nics to the init netns */
2672 int lxc_restore_phys_nics_to_netns(struct lxc_handler *handler)
2673 {
2674 int ret;
2675 int oldfd;
2676 char ifname[IFNAMSIZ];
2677 struct lxc_list *iterator;
2678 int netnsfd = handler->nsfd[LXC_NS_NET];
2679 struct lxc_conf *conf = handler->conf;
2680
2681 /* We need CAP_NET_ADMIN in the parent namespace in order to setns() to
2682 * the parent network namespace. We won't have this capability if we are
2683 * unprivileged.
2684 */
2685 if (!handler->am_root)
2686 return 0;
2687
2688 TRACE("Moving physical network devices back to parent network namespace");
2689
2690 oldfd = lxc_preserve_ns(lxc_raw_getpid(), "net");
2691 if (oldfd < 0) {
2692 SYSERROR("Failed to preserve network namespace");
2693 return -1;
2694 }
2695
2696 ret = setns(netnsfd, CLONE_NEWNET);
2697 if (ret < 0) {
2698 SYSERROR("Failed to enter network namespace");
2699 close(oldfd);
2700 return -1;
2701 }
2702
2703 lxc_list_for_each(iterator, &conf->network) {
2704 struct lxc_netdev *netdev = iterator->elem;
2705
2706 if (netdev->type != LXC_NET_PHYS)
2707 continue;
2708
2709 /* Retrieve the name of the interface in the container's network
2710 * namespace.
2711 */
2712 if (!if_indextoname(netdev->ifindex, ifname)) {
2713 WARN("No interface corresponding to ifindex %d",
2714 netdev->ifindex);
2715 continue;
2716 }
2717
2718 ret = lxc_netdev_move_by_name(ifname, 1, netdev->link);
2719 if (ret < 0)
2720 WARN("Error moving network device \"%s\" back to "
2721 "network namespace", ifname);
2722 else
2723 TRACE("Moved network device \"%s\" back to network "
2724 "namespace", ifname);
2725 }
2726
2727 ret = setns(oldfd, CLONE_NEWNET);
2728 close(oldfd);
2729 if (ret < 0) {
2730 SYSERROR("Failed to enter network namespace");
2731 return -1;
2732 }
2733
2734 return 0;
2735 }
2736
2737 static int setup_hw_addr(char *hwaddr, const char *ifname)
2738 {
2739 struct sockaddr sockaddr;
2740 struct ifreq ifr;
2741 int ret, fd;
2742
2743 ret = lxc_convert_mac(hwaddr, &sockaddr);
2744 if (ret) {
2745 errno = -ret;
2746 SYSERROR("Mac address \"%s\" conversion failed", hwaddr);
2747 return -1;
2748 }
2749
2750 memcpy(ifr.ifr_name, ifname, IFNAMSIZ);
2751 ifr.ifr_name[IFNAMSIZ-1] = '\0';
2752 memcpy((char *) &ifr.ifr_hwaddr, (char *) &sockaddr, sizeof(sockaddr));
2753
2754 fd = socket(AF_INET, SOCK_DGRAM, 0);
2755 if (fd < 0)
2756 return -1;
2757
2758 ret = ioctl(fd, SIOCSIFHWADDR, &ifr);
2759 if (ret)
2760 SYSERROR("Failed to perform ioctl");
2761
2762 close(fd);
2763
2764 DEBUG("Mac address \"%s\" on \"%s\" has been setup", hwaddr,
2765 ifr.ifr_name);
2766
2767 return ret;
2768 }
2769
2770 static int setup_ipv4_addr(struct lxc_list *ip, int ifindex)
2771 {
2772 struct lxc_list *iterator;
2773 int err;
2774
2775 lxc_list_for_each(iterator, ip) {
2776 struct lxc_inetdev *inetdev = iterator->elem;
2777
2778 err = lxc_ipv4_addr_add(ifindex, &inetdev->addr,
2779 &inetdev->bcast, inetdev->prefix);
2780 if (err) {
2781 errno = -err;
2782 SYSERROR("Failed to setup ipv4 address for network device "
2783 "with eifindex %d", ifindex);
2784 return -1;
2785 }
2786 }
2787
2788 return 0;
2789 }
2790
2791 static int setup_ipv6_addr(struct lxc_list *ip, int ifindex)
2792 {
2793 struct lxc_list *iterator;
2794 int err;
2795
2796 lxc_list_for_each(iterator, ip) {
2797 struct lxc_inet6dev *inet6dev = iterator->elem;
2798
2799 err = lxc_ipv6_addr_add(ifindex, &inet6dev->addr,
2800 &inet6dev->mcast, &inet6dev->acast,
2801 inet6dev->prefix);
2802 if (err) {
2803 errno = -err;
2804 SYSERROR("Failed to setup ipv6 address for network device "
2805 "with eifindex %d", ifindex);
2806 return -1;
2807 }
2808 }
2809
2810 return 0;
2811 }
2812
2813 static int lxc_setup_netdev_in_child_namespaces(struct lxc_netdev *netdev)
2814 {
2815 char ifname[IFNAMSIZ];
2816 int err;
2817 const char *net_type_name;
2818 char *current_ifname = ifname;
2819
2820 /* empty network namespace */
2821 if (!netdev->ifindex) {
2822 if (netdev->flags & IFF_UP) {
2823 err = lxc_netdev_up("lo");
2824 if (err) {
2825 errno = -err;
2826 SYSERROR("Failed to set the loopback network device up");
2827 return -1;
2828 }
2829 }
2830
2831 if (netdev->type == LXC_NET_EMPTY)
2832 return 0;
2833
2834 if (netdev->type == LXC_NET_NONE)
2835 return 0;
2836
2837 if (netdev->type != LXC_NET_VETH) {
2838 net_type_name = lxc_net_type_to_str(netdev->type);
2839 ERROR("%s networks are not supported for containers "
2840 "not setup up by privileged users", net_type_name);
2841 return -1;
2842 }
2843
2844 netdev->ifindex = if_nametoindex(netdev->name);
2845 }
2846
2847 /* get the new ifindex in case of physical netdev */
2848 if (netdev->type == LXC_NET_PHYS) {
2849 netdev->ifindex = if_nametoindex(netdev->link);
2850 if (!netdev->ifindex) {
2851 ERROR("Failed to get ifindex for network device \"%s\"",
2852 netdev->link);
2853 return -1;
2854 }
2855 }
2856
2857 /* retrieve the name of the interface */
2858 if (!if_indextoname(netdev->ifindex, current_ifname)) {
2859 ERROR("Failed get name for network device with ifindex %d",
2860 netdev->ifindex);
2861 return -1;
2862 }
2863
2864 /* Default: let the system to choose one interface name.
2865 * When the IFLA_IFNAME attribute is passed something like "<prefix>%d"
2866 * netlink will replace the format specifier with an appropriate index.
2867 */
2868 if (netdev->name[0] == '\0') {
2869 if (netdev->type == LXC_NET_PHYS)
2870 (void)strlcpy(netdev->name, netdev->link, IFNAMSIZ);
2871 else
2872 (void)strlcpy(netdev->name, "eth%d", IFNAMSIZ);
2873 }
2874
2875 /* rename the interface name */
2876 if (strcmp(ifname, netdev->name) != 0) {
2877 err = lxc_netdev_rename_by_name(ifname, netdev->name);
2878 if (err) {
2879 errno = -err;
2880 SYSERROR("Failed to rename network device \"%s\" to \"%s\"",
2881 ifname, netdev->name);
2882 return -1;
2883 }
2884 }
2885
2886 /* Re-read the name of the interface because its name has changed
2887 * and would be automatically allocated by the system
2888 */
2889 if (!if_indextoname(netdev->ifindex, current_ifname)) {
2890 ERROR("Failed get name for network device with ifindex %d",
2891 netdev->ifindex);
2892 return -1;
2893 }
2894
2895 /* Now update the recorded name of the network device to reflect the
2896 * name of the network device in the child's network namespace. We will
2897 * later on send this information back to the parent.
2898 */
2899 (void)strlcpy(netdev->name, current_ifname, IFNAMSIZ);
2900
2901 /* set a mac address */
2902 if (netdev->hwaddr) {
2903 if (setup_hw_addr(netdev->hwaddr, current_ifname)) {
2904 ERROR("Failed to setup hw address for network device \"%s\"",
2905 current_ifname);
2906 return -1;
2907 }
2908 }
2909
2910 /* setup ipv4 addresses on the interface */
2911 if (setup_ipv4_addr(&netdev->ipv4, netdev->ifindex)) {
2912 ERROR("Failed to setup ip addresses for network device \"%s\"",
2913 ifname);
2914 return -1;
2915 }
2916
2917 /* setup ipv6 addresses on the interface */
2918 if (setup_ipv6_addr(&netdev->ipv6, netdev->ifindex)) {
2919 ERROR("Failed to setup ipv6 addresses for network device \"%s\"",
2920 ifname);
2921 return -1;
2922 }
2923
2924 /* set the network device up */
2925 if (netdev->flags & IFF_UP) {
2926 err = lxc_netdev_up(current_ifname);
2927 if (err) {
2928 errno = -err;
2929 SYSERROR("Failed to set network device \"%s\" up",
2930 current_ifname);
2931 return -1;
2932 }
2933
2934 /* the network is up, make the loopback up too */
2935 err = lxc_netdev_up("lo");
2936 if (err) {
2937 errno = -err;
2938 SYSERROR("Failed to set the loopback network device up");
2939 return -1;
2940 }
2941 }
2942
2943 /* We can only set up the default routes after bringing
2944 * up the interface, sine bringing up the interface adds
2945 * the link-local routes and we can't add a default
2946 * route if the gateway is not reachable. */
2947
2948 /* setup ipv4 gateway on the interface */
2949 if (netdev->ipv4_gateway) {
2950 if (!(netdev->flags & IFF_UP)) {
2951 ERROR("Cannot add ipv4 gateway for network device "
2952 "\"%s\" when not bringing up the interface", ifname);
2953 return -1;
2954 }
2955
2956 if (lxc_list_empty(&netdev->ipv4)) {
2957 ERROR("Cannot add ipv4 gateway for network device "
2958 "\"%s\" when not assigning an address", ifname);
2959 return -1;
2960 }
2961
2962 err = lxc_ipv4_gateway_add(netdev->ifindex, netdev->ipv4_gateway);
2963 if (err) {
2964 err = lxc_ipv4_dest_add(netdev->ifindex, netdev->ipv4_gateway);
2965 if (err) {
2966 errno = -err;
2967 SYSERROR("Failed to add ipv4 dest for network device \"%s\"",
2968 ifname);
2969 }
2970
2971 err = lxc_ipv4_gateway_add(netdev->ifindex, netdev->ipv4_gateway);
2972 if (err) {
2973 errno = -err;
2974 SYSERROR("Failed to setup ipv4 gateway for network device \"%s\"",
2975 ifname);
2976
2977 if (netdev->ipv4_gateway_auto) {
2978 char buf[INET_ADDRSTRLEN];
2979 inet_ntop(AF_INET, netdev->ipv4_gateway, buf, sizeof(buf));
2980 ERROR("Fried to set autodetected ipv4 gateway \"%s\"", buf);
2981 }
2982 return -1;
2983 }
2984 }
2985 }
2986
2987 /* setup ipv6 gateway on the interface */
2988 if (netdev->ipv6_gateway) {
2989 if (!(netdev->flags & IFF_UP)) {
2990 ERROR("Cannot add ipv6 gateway for network device "
2991 "\"%s\" when not bringing up the interface", ifname);
2992 return -1;
2993 }
2994
2995 if (lxc_list_empty(&netdev->ipv6) && !IN6_IS_ADDR_LINKLOCAL(netdev->ipv6_gateway)) {
2996 ERROR("Cannot add ipv6 gateway for network device "
2997 "\"%s\" when not assigning an address", ifname);
2998 return -1;
2999 }
3000
3001 err = lxc_ipv6_gateway_add(netdev->ifindex, netdev->ipv6_gateway);
3002 if (err) {
3003 err = lxc_ipv6_dest_add(netdev->ifindex, netdev->ipv6_gateway);
3004 if (err) {
3005 errno = -err;
3006 SYSERROR("Failed to add ipv6 dest for network device \"%s\"",
3007 ifname);
3008 }
3009
3010 err = lxc_ipv6_gateway_add(netdev->ifindex, netdev->ipv6_gateway);
3011 if (err) {
3012 errno = -err;
3013 SYSERROR("Failed to setup ipv6 gateway for network device \"%s\"",
3014 ifname);
3015
3016 if (netdev->ipv6_gateway_auto) {
3017 char buf[INET6_ADDRSTRLEN];
3018 inet_ntop(AF_INET6, netdev->ipv6_gateway, buf, sizeof(buf));
3019 ERROR("Tried to set autodetected ipv6 "
3020 "gateway for network device "
3021 "\"%s\"", buf);
3022 }
3023 return -1;
3024 }
3025 }
3026 }
3027
3028 DEBUG("Network device \"%s\" has been setup", current_ifname);
3029
3030 return 0;
3031 }
3032
3033 int lxc_setup_network_in_child_namespaces(const struct lxc_conf *conf,
3034 struct lxc_list *network)
3035 {
3036 struct lxc_list *iterator;
3037 struct lxc_netdev *netdev;
3038
3039 lxc_list_for_each(iterator, network) {
3040 netdev = iterator->elem;
3041
3042 if (lxc_setup_netdev_in_child_namespaces(netdev)) {
3043 ERROR("failed to setup netdev");
3044 return -1;
3045 }
3046 }
3047
3048 if (!lxc_list_empty(network))
3049 INFO("network has been setup");
3050
3051 return 0;
3052 }
3053
3054 int lxc_network_send_veth_names_to_child(struct lxc_handler *handler)
3055 {
3056 struct lxc_list *iterator;
3057 struct lxc_list *network = &handler->conf->network;
3058 int data_sock = handler->data_sock[0];
3059
3060 if (handler->am_root)
3061 return 0;
3062
3063 lxc_list_for_each(iterator, network) {
3064 int ret;
3065 struct lxc_netdev *netdev = iterator->elem;
3066
3067 if (netdev->type != LXC_NET_VETH)
3068 continue;
3069
3070 ret = lxc_send_nointr(data_sock, netdev->name, IFNAMSIZ, MSG_NOSIGNAL);
3071 if (ret < 0)
3072 return -1;
3073 TRACE("Sent network device name \"%s\" to child", netdev->name);
3074 }
3075
3076 return 0;
3077 }
3078
3079 int lxc_network_recv_veth_names_from_parent(struct lxc_handler *handler)
3080 {
3081 struct lxc_list *iterator;
3082 struct lxc_list *network = &handler->conf->network;
3083 int data_sock = handler->data_sock[1];
3084
3085 if (handler->am_root)
3086 return 0;
3087
3088 lxc_list_for_each(iterator, network) {
3089 int ret;
3090 struct lxc_netdev *netdev = iterator->elem;
3091
3092 if (netdev->type != LXC_NET_VETH)
3093 continue;
3094
3095 ret = lxc_recv_nointr(data_sock, netdev->name, IFNAMSIZ, 0);
3096 if (ret < 0)
3097 return -1;
3098 TRACE("Received network device name \"%s\" from parent", netdev->name);
3099 }
3100
3101 return 0;
3102 }
3103
3104 int lxc_network_send_name_and_ifindex_to_parent(struct lxc_handler *handler)
3105 {
3106 struct lxc_list *iterator, *network;
3107 int data_sock = handler->data_sock[0];
3108
3109 if (!handler->am_root)
3110 return 0;
3111
3112 network = &handler->conf->network;
3113 lxc_list_for_each(iterator, network) {
3114 int ret;
3115 struct lxc_netdev *netdev = iterator->elem;
3116
3117 /* Send network device name in the child's namespace to parent. */
3118 ret = lxc_send_nointr(data_sock, netdev->name, IFNAMSIZ, MSG_NOSIGNAL);
3119 if (ret < 0)
3120 return -1;
3121
3122 /* Send network device ifindex in the child's namespace to
3123 * parent.
3124 */
3125 ret = lxc_send_nointr(data_sock, &netdev->ifindex, sizeof(netdev->ifindex), MSG_NOSIGNAL);
3126 if (ret < 0)
3127 return -1;
3128 }
3129
3130 TRACE("Sent network device names and ifindices to parent");
3131 return 0;
3132 }
3133
3134 int lxc_network_recv_name_and_ifindex_from_child(struct lxc_handler *handler)
3135 {
3136 struct lxc_list *iterator, *network;
3137 int data_sock = handler->data_sock[1];
3138
3139 if (!handler->am_root)
3140 return 0;
3141
3142 network = &handler->conf->network;
3143 lxc_list_for_each(iterator, network) {
3144 int ret;
3145 struct lxc_netdev *netdev = iterator->elem;
3146
3147 /* Receive network device name in the child's namespace to
3148 * parent.
3149 */
3150 ret = lxc_recv_nointr(data_sock, netdev->name, IFNAMSIZ, 0);
3151 if (ret < 0)
3152 return -1;
3153
3154 /* Receive network device ifindex in the child's namespace to
3155 * parent.
3156 */
3157 ret = lxc_recv_nointr(data_sock, &netdev->ifindex, sizeof(netdev->ifindex), 0);
3158 if (ret < 0)
3159 return -1;
3160 }
3161
3162 return 0;
3163 }
3164
3165 void lxc_delete_network(struct lxc_handler *handler)
3166 {
3167 bool bret;
3168
3169 if (handler->am_root)
3170 bret = lxc_delete_network_priv(handler);
3171 else
3172 bret = lxc_delete_network_unpriv(handler);
3173 if (!bret)
3174 DEBUG("Failed to delete network devices");
3175 else
3176 DEBUG("Deleted network devices");
3177 }
3178
3179 int lxc_netns_set_nsid(int fd)
3180 {
3181 int ret;
3182 char buf[NLMSG_ALIGN(sizeof(struct nlmsghdr)) +
3183 NLMSG_ALIGN(sizeof(struct rtgenmsg)) +
3184 NLMSG_ALIGN(1024)];
3185 struct nl_handler nlh;
3186 struct nlmsghdr *hdr;
3187 struct rtgenmsg *msg;
3188 int saved_errno;
3189 const __s32 ns_id = -1;
3190 const __u32 netns_fd = fd;
3191
3192 ret = netlink_open(&nlh, NETLINK_ROUTE);
3193 if (ret < 0)
3194 return -1;
3195
3196 memset(buf, 0, sizeof(buf));
3197
3198 #pragma GCC diagnostic push
3199 #pragma GCC diagnostic ignored "-Wcast-align"
3200 hdr = (struct nlmsghdr *)buf;
3201 msg = (struct rtgenmsg *)NLMSG_DATA(hdr);
3202 #pragma GCC diagnostic pop
3203
3204 hdr->nlmsg_len = NLMSG_LENGTH(sizeof(*msg));
3205 hdr->nlmsg_type = RTM_NEWNSID;
3206 hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
3207 hdr->nlmsg_pid = 0;
3208 hdr->nlmsg_seq = RTM_NEWNSID;
3209 msg->rtgen_family = AF_UNSPEC;
3210
3211 ret = addattr(hdr, 1024, __LXC_NETNSA_FD, &netns_fd, sizeof(netns_fd));
3212 if (ret < 0)
3213 goto on_error;
3214
3215 ret = addattr(hdr, 1024, __LXC_NETNSA_NSID, &ns_id, sizeof(ns_id));
3216 if (ret < 0)
3217 goto on_error;
3218
3219 ret = __netlink_transaction(&nlh, hdr, hdr);
3220
3221 on_error:
3222 saved_errno = errno;
3223 netlink_close(&nlh);
3224 errno = saved_errno;
3225
3226 return ret;
3227 }
3228
3229 static int parse_rtattr(struct rtattr *tb[], int max, struct rtattr *rta, int len)
3230 {
3231
3232 memset(tb, 0, sizeof(struct rtattr *) * (max + 1));
3233
3234 while (RTA_OK(rta, len)) {
3235 unsigned short type = rta->rta_type;
3236
3237 if ((type <= max) && (!tb[type]))
3238 tb[type] = rta;
3239
3240 #pragma GCC diagnostic push
3241 #pragma GCC diagnostic ignored "-Wcast-align"
3242 rta = RTA_NEXT(rta, len);
3243 #pragma GCC diagnostic pop
3244 }
3245
3246 return 0;
3247 }
3248
3249 static inline __s32 rta_getattr_s32(const struct rtattr *rta)
3250 {
3251 return *(__s32 *)RTA_DATA(rta);
3252 }
3253
3254 #ifndef NETNS_RTA
3255 #define NETNS_RTA(r) \
3256 ((struct rtattr *)(((char *)(r)) + NLMSG_ALIGN(sizeof(struct rtgenmsg))))
3257 #endif
3258
3259 int lxc_netns_get_nsid(int fd)
3260 {
3261 int ret;
3262 ssize_t len;
3263 char buf[NLMSG_ALIGN(sizeof(struct nlmsghdr)) +
3264 NLMSG_ALIGN(sizeof(struct rtgenmsg)) +
3265 NLMSG_ALIGN(1024)];
3266 struct rtattr *tb[__LXC_NETNSA_MAX + 1];
3267 struct nl_handler nlh;
3268 struct nlmsghdr *hdr;
3269 struct rtgenmsg *msg;
3270 int saved_errno;
3271 __u32 netns_fd = fd;
3272
3273 ret = netlink_open(&nlh, NETLINK_ROUTE);
3274 if (ret < 0)
3275 return -1;
3276
3277 memset(buf, 0, sizeof(buf));
3278
3279 #pragma GCC diagnostic push
3280 #pragma GCC diagnostic ignored "-Wcast-align"
3281 hdr = (struct nlmsghdr *)buf;
3282 msg = (struct rtgenmsg *)NLMSG_DATA(hdr);
3283 #pragma GCC diagnostic pop
3284
3285 hdr->nlmsg_len = NLMSG_LENGTH(sizeof(*msg));
3286 hdr->nlmsg_type = RTM_GETNSID;
3287 hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
3288 hdr->nlmsg_pid = 0;
3289 hdr->nlmsg_seq = RTM_GETNSID;
3290 msg->rtgen_family = AF_UNSPEC;
3291
3292 ret = addattr(hdr, 1024, __LXC_NETNSA_FD, &netns_fd, sizeof(netns_fd));
3293 if (ret == 0)
3294 ret = __netlink_transaction(&nlh, hdr, hdr);
3295
3296 saved_errno = errno;
3297 netlink_close(&nlh);
3298 errno = saved_errno;
3299 if (ret < 0)
3300 return -1;
3301
3302 errno = EINVAL;
3303 msg = NLMSG_DATA(hdr);
3304 len = hdr->nlmsg_len - NLMSG_SPACE(sizeof(*msg));
3305 if (len < 0)
3306 return -1;
3307
3308 #pragma GCC diagnostic push
3309 #pragma GCC diagnostic ignored "-Wcast-align"
3310 parse_rtattr(tb, __LXC_NETNSA_MAX, NETNS_RTA(msg), len);
3311 if (tb[__LXC_NETNSA_NSID])
3312 return rta_getattr_s32(tb[__LXC_NETNSA_NSID]);
3313 #pragma GCC diagnostic pop
3314
3315 return -1;
3316 }
LXC mirror