2021-10-11 12:01:31 +02:00
|
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
|
|
|
|
|
|
/* PASST - Plug A Simple Socket Transport
|
|
|
|
|
* for qemu/UNIX domain socket mode
|
|
|
|
|
*
|
|
|
|
|
* PASTA - Pack A Subtle Tap Abstraction
|
|
|
|
|
* for network namespace/tap device mode
|
|
|
|
|
*
|
|
|
|
|
* netlink.c - rtnetlink routines: interfaces, addresses, routes
|
|
|
|
|
*
|
|
|
|
|
* Copyright (c) 2020-2021 Red Hat GmbH
|
|
|
|
|
* Author: Stefano Brivio <sbrivio@redhat.com>
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include <sched.h>
|
|
|
|
|
#include <string.h>
|
|
|
|
|
#include <stddef.h>
|
|
|
|
|
#include <errno.h>
|
|
|
|
|
#include <sys/types.h>
|
|
|
|
|
#include <limits.h>
|
|
|
|
|
#include <stdlib.h>
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
#include <stdbool.h>
|
2021-10-11 12:01:31 +02:00
|
|
|
#include <stdint.h>
|
|
|
|
|
#include <unistd.h>
|
|
|
|
|
#include <arpa/inet.h>
|
|
|
|
|
#include <netinet/in.h>
|
2021-10-21 04:26:08 +02:00
|
|
|
#include <netinet/if_ether.h>
|
|
|
|
|
|
2021-10-11 12:01:31 +02:00
|
|
|
#include <linux/netlink.h>
|
|
|
|
|
#include <linux/rtnetlink.h>
|
|
|
|
|
|
|
|
|
|
#include "util.h"
|
|
|
|
|
#include "passt.h"
|
2022-09-24 09:53:15 +02:00
|
|
|
#include "log.h"
|
2021-10-11 12:01:31 +02:00
|
|
|
#include "netlink.h"
|
|
|
|
|
|
|
|
|
|
/* Socket in init, in target namespace, sequence (just needs to be monotonic) */
|
|
|
|
|
static int nl_sock = -1;
|
|
|
|
|
static int nl_sock_ns = -1;
|
|
|
|
|
static int nl_seq;
|
|
|
|
|
|
|
|
|
|
/**
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
* nl_sock_init_do() - Set up netlink sockets in init or target namespace
|
|
|
|
|
* @arg: Execution context, if running from namespace, NULL otherwise
|
2021-10-11 12:01:31 +02:00
|
|
|
*
|
|
|
|
|
* Return: 0
|
|
|
|
|
*/
|
2021-10-21 04:26:08 +02:00
|
|
|
static int nl_sock_init_do(void *arg)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
|
|
|
|
struct sockaddr_nl addr = { .nl_family = AF_NETLINK, };
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
int *s = arg ? &nl_sock_ns : &nl_sock;
|
2022-01-25 19:55:54 +01:00
|
|
|
#ifdef NETLINK_GET_STRICT_CHK
|
|
|
|
|
int y = 1;
|
|
|
|
|
#endif
|
2021-10-11 12:01:31 +02:00
|
|
|
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
if (arg)
|
|
|
|
|
ns_enter((struct ctx *)arg);
|
|
|
|
|
|
2023-02-07 16:10:46 +01:00
|
|
|
*s = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE);
|
|
|
|
|
if (*s < 0 || bind(*s, (struct sockaddr *)&addr, sizeof(addr))) {
|
2021-10-11 12:01:31 +02:00
|
|
|
*s = -1;
|
|
|
|
|
return 0;
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
}
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2022-01-25 19:55:54 +01:00
|
|
|
#ifdef NETLINK_GET_STRICT_CHK
|
2022-04-05 07:10:30 +02:00
|
|
|
if (setsockopt(*s, SOL_NETLINK, NETLINK_GET_STRICT_CHK, &y, sizeof(y)))
|
|
|
|
|
debug("netlink: cannot set NETLINK_GET_STRICT_CHK on %i", *s);
|
2022-01-25 19:55:54 +01:00
|
|
|
#endif
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
return 0;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
* nl_sock_init() - Call nl_sock_init_do(), won't return on failure
|
2021-10-11 12:01:31 +02:00
|
|
|
* @c: Execution context
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
* @ns: Get socket in namespace, not in init
|
2021-10-11 12:01:31 +02:00
|
|
|
*/
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
void nl_sock_init(const struct ctx *c, bool ns)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
if (ns) {
|
2021-10-21 04:26:08 +02:00
|
|
|
NS_CALL(nl_sock_init_do, c);
|
2021-10-11 12:01:31 +02:00
|
|
|
if (nl_sock_ns == -1)
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
goto fail;
|
2021-10-11 12:01:31 +02:00
|
|
|
} else {
|
2021-10-21 04:26:08 +02:00
|
|
|
nl_sock_init_do(NULL);
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (nl_sock == -1)
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
goto fail;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
fail:
|
2023-02-15 09:24:37 +01:00
|
|
|
die("Failed to get netlink socket");
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_req() - Send netlink request and read response
|
|
|
|
|
* @ns: Use netlink socket in namespace
|
|
|
|
|
* @buf: Buffer for response (at least BUFSIZ long)
|
|
|
|
|
* @req: Request with netlink header
|
|
|
|
|
* @len: Request length
|
|
|
|
|
*
|
|
|
|
|
* Return: received length on success, negative error code on failure
|
|
|
|
|
*/
|
2022-03-26 07:23:21 +01:00
|
|
|
static int nl_req(int ns, char *buf, const void *req, ssize_t len)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
2021-10-20 00:05:11 +02:00
|
|
|
int s = ns ? nl_sock_ns : nl_sock, done = 0;
|
2021-10-11 12:01:31 +02:00
|
|
|
char flush[BUFSIZ];
|
2021-10-20 00:05:11 +02:00
|
|
|
ssize_t n;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
|
|
|
|
while (!done && (n = recv(s, flush, sizeof(flush), MSG_DONTWAIT)) > 0) {
|
|
|
|
|
struct nlmsghdr *nh = (struct nlmsghdr *)flush;
|
2021-10-20 00:05:11 +02:00
|
|
|
size_t nm = n;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2021-10-20 00:05:11 +02:00
|
|
|
for ( ; NLMSG_OK(nh, nm); nh = NLMSG_NEXT(nh, nm)) {
|
2021-10-11 12:01:31 +02:00
|
|
|
if (nh->nlmsg_type == NLMSG_DONE ||
|
|
|
|
|
nh->nlmsg_type == NLMSG_ERROR) {
|
|
|
|
|
done = 1;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if ((send(s, req, len, 0) < len) || (len = recv(s, buf, BUFSIZ, 0)) < 0)
|
|
|
|
|
return -errno;
|
|
|
|
|
|
|
|
|
|
return len;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2022-07-22 07:31:13 +02:00
|
|
|
* nl_get_ext_if() - Get interface index supporting IP version being probed
|
|
|
|
|
* @af: Address family (AF_INET or AF_INET6) to look for connectivity
|
|
|
|
|
* for.
|
2021-10-11 12:01:31 +02:00
|
|
|
*
|
|
|
|
|
* Return: interface index, 0 if not found
|
|
|
|
|
*/
|
2022-07-22 07:31:13 +02:00
|
|
|
unsigned int nl_get_ext_if(sa_family_t af)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
|
|
|
|
struct { struct nlmsghdr nlh; struct rtmsg rtm; } req = {
|
|
|
|
|
.nlh.nlmsg_type = RTM_GETROUTE,
|
2021-10-20 00:05:11 +02:00
|
|
|
.nlh.nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP,
|
2021-10-11 12:01:31 +02:00
|
|
|
.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg)),
|
|
|
|
|
.nlh.nlmsg_seq = nl_seq++,
|
|
|
|
|
|
|
|
|
|
.rtm.rtm_table = RT_TABLE_MAIN,
|
|
|
|
|
.rtm.rtm_scope = RT_SCOPE_UNIVERSE,
|
|
|
|
|
.rtm.rtm_type = RTN_UNICAST,
|
2022-07-22 07:31:13 +02:00
|
|
|
.rtm.rtm_family = af,
|
2021-10-11 12:01:31 +02:00
|
|
|
};
|
|
|
|
|
struct nlmsghdr *nh;
|
|
|
|
|
struct rtattr *rta;
|
|
|
|
|
char buf[BUFSIZ];
|
2022-04-05 07:10:30 +02:00
|
|
|
ssize_t n;
|
|
|
|
|
size_t na;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2022-04-05 07:10:30 +02:00
|
|
|
if ((n = nl_req(0, buf, &req, sizeof(req))) < 0)
|
|
|
|
|
return 0;
|
|
|
|
|
|
2021-10-11 12:01:31 +02:00
|
|
|
nh = (struct nlmsghdr *)buf;
|
|
|
|
|
|
|
|
|
|
for ( ; NLMSG_OK(nh, n); nh = NLMSG_NEXT(nh, n)) {
|
2022-09-28 06:33:19 +02:00
|
|
|
struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh);
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2022-07-22 07:31:13 +02:00
|
|
|
if (rtm->rtm_dst_len || rtm->rtm_family != af)
|
2021-10-11 12:01:31 +02:00
|
|
|
continue;
|
|
|
|
|
|
2021-10-20 00:05:11 +02:00
|
|
|
for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na);
|
|
|
|
|
rta = RTA_NEXT(rta, na)) {
|
2021-10-11 12:01:31 +02:00
|
|
|
unsigned int ifi;
|
|
|
|
|
|
|
|
|
|
if (rta->rta_type != RTA_OIF)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
ifi = *(unsigned int *)RTA_DATA(rta);
|
|
|
|
|
|
2022-07-22 07:31:13 +02:00
|
|
|
return ifi;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_route() - Get/set default gateway for given interface and address family
|
|
|
|
|
* @ns: Use netlink socket in namespace
|
|
|
|
|
* @ifi: Interface index
|
|
|
|
|
* @af: Address family
|
|
|
|
|
* @gw: Default gateway to fill if zero, to set if not
|
|
|
|
|
*/
|
|
|
|
|
void nl_route(int ns, unsigned int ifi, sa_family_t af, void *gw)
|
|
|
|
|
{
|
|
|
|
|
int set = (af == AF_INET6 && !IN6_IS_ADDR_UNSPECIFIED(gw)) ||
|
|
|
|
|
(af == AF_INET && *(uint32_t *)gw);
|
|
|
|
|
struct req_t {
|
|
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct rtmsg rtm;
|
|
|
|
|
struct rtattr rta;
|
|
|
|
|
unsigned int ifi;
|
|
|
|
|
union {
|
|
|
|
|
struct {
|
|
|
|
|
struct rtattr rta_dst;
|
|
|
|
|
struct in6_addr d;
|
|
|
|
|
struct rtattr rta_gw;
|
|
|
|
|
struct in6_addr a;
|
|
|
|
|
} r6;
|
|
|
|
|
struct {
|
|
|
|
|
struct rtattr rta_dst;
|
|
|
|
|
uint32_t d;
|
|
|
|
|
struct rtattr rta_gw;
|
|
|
|
|
uint32_t a;
|
|
|
|
|
} r4;
|
2021-10-21 04:26:08 +02:00
|
|
|
} set;
|
2021-10-11 12:01:31 +02:00
|
|
|
} req = {
|
|
|
|
|
.nlh.nlmsg_type = set ? RTM_NEWROUTE : RTM_GETROUTE,
|
|
|
|
|
.nlh.nlmsg_flags = NLM_F_REQUEST,
|
|
|
|
|
.nlh.nlmsg_seq = nl_seq++,
|
|
|
|
|
|
|
|
|
|
.rtm.rtm_family = af,
|
|
|
|
|
.rtm.rtm_table = RT_TABLE_MAIN,
|
|
|
|
|
.rtm.rtm_scope = RT_SCOPE_UNIVERSE,
|
|
|
|
|
.rtm.rtm_type = RTN_UNICAST,
|
|
|
|
|
|
|
|
|
|
.rta.rta_type = RTA_OIF,
|
|
|
|
|
.rta.rta_len = RTA_LENGTH(sizeof(unsigned int)),
|
|
|
|
|
.ifi = ifi,
|
|
|
|
|
};
|
|
|
|
|
struct nlmsghdr *nh;
|
|
|
|
|
struct rtattr *rta;
|
|
|
|
|
struct rtmsg *rtm;
|
|
|
|
|
char buf[BUFSIZ];
|
2022-04-05 07:10:30 +02:00
|
|
|
ssize_t n;
|
|
|
|
|
size_t na;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
|
|
|
|
if (set) {
|
|
|
|
|
if (af == AF_INET6) {
|
2021-10-21 04:26:08 +02:00
|
|
|
size_t rta_len = RTA_LENGTH(sizeof(req.set.r6.d));
|
|
|
|
|
|
2022-09-28 06:33:27 +02:00
|
|
|
req.nlh.nlmsg_len = offsetof(struct req_t, set.r6)
|
|
|
|
|
+ sizeof(req.set.r6);
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2021-10-21 04:26:08 +02:00
|
|
|
req.set.r6.rta_dst.rta_type = RTA_DST;
|
|
|
|
|
req.set.r6.rta_dst.rta_len = rta_len;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2021-10-21 04:26:08 +02:00
|
|
|
memcpy(&req.set.r6.a, gw, sizeof(req.set.r6.a));
|
|
|
|
|
req.set.r6.rta_gw.rta_type = RTA_GATEWAY;
|
|
|
|
|
req.set.r6.rta_gw.rta_len = rta_len;
|
2021-10-11 12:01:31 +02:00
|
|
|
} else {
|
2021-10-21 04:26:08 +02:00
|
|
|
size_t rta_len = RTA_LENGTH(sizeof(req.set.r4.d));
|
|
|
|
|
|
2022-09-28 06:33:27 +02:00
|
|
|
req.nlh.nlmsg_len = offsetof(struct req_t, set.r4)
|
|
|
|
|
+ sizeof(req.set.r4);
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2021-10-21 04:26:08 +02:00
|
|
|
req.set.r4.rta_dst.rta_type = RTA_DST;
|
|
|
|
|
req.set.r4.rta_dst.rta_len = rta_len;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2021-10-21 04:26:08 +02:00
|
|
|
req.set.r4.a = *(uint32_t *)gw;
|
|
|
|
|
req.set.r4.rta_gw.rta_type = RTA_GATEWAY;
|
|
|
|
|
req.set.r4.rta_gw.rta_len = rta_len;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
req.rtm.rtm_protocol = RTPROT_BOOT;
|
|
|
|
|
req.nlh.nlmsg_flags |= NLM_F_ACK | NLM_F_EXCL | NLM_F_CREATE;
|
|
|
|
|
} else {
|
2021-10-21 04:26:08 +02:00
|
|
|
req.nlh.nlmsg_len = offsetof(struct req_t, set.r6);
|
2021-10-11 12:01:31 +02:00
|
|
|
req.nlh.nlmsg_flags |= NLM_F_DUMP;
|
|
|
|
|
}
|
|
|
|
|
|
2022-05-01 06:55:49 +02:00
|
|
|
if ((n = nl_req(ns, buf, &req, req.nlh.nlmsg_len)) < 0 || set)
|
2021-10-11 12:01:31 +02:00
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
nh = (struct nlmsghdr *)buf;
|
|
|
|
|
for ( ; NLMSG_OK(nh, n); nh = NLMSG_NEXT(nh, n)) {
|
|
|
|
|
if (nh->nlmsg_type != RTM_NEWROUTE)
|
|
|
|
|
goto next;
|
|
|
|
|
|
|
|
|
|
rtm = (struct rtmsg *)NLMSG_DATA(nh);
|
|
|
|
|
if (rtm->rtm_dst_len)
|
|
|
|
|
continue;
|
|
|
|
|
|
2021-10-20 00:05:11 +02:00
|
|
|
for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na);
|
|
|
|
|
rta = RTA_NEXT(rta, na)) {
|
2021-10-11 12:01:31 +02:00
|
|
|
if (rta->rta_type != RTA_GATEWAY)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
memcpy(gw, RTA_DATA(rta), RTA_PAYLOAD(rta));
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
next:
|
|
|
|
|
if (nh->nlmsg_type == NLMSG_DONE)
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_addr() - Get/set IP addresses
|
|
|
|
|
* @ns: Use netlink socket in namespace
|
|
|
|
|
* @ifi: Interface index
|
|
|
|
|
* @af: Address family
|
|
|
|
|
* @addr: Global address to fill if zero, to set if not, ignored if NULL
|
2021-10-19 09:01:27 +02:00
|
|
|
* @prefix_len: Mask or prefix length, set or fetched (for IPv4)
|
2021-10-11 12:01:31 +02:00
|
|
|
* @addr_l: Link-scoped address to fill, NULL if not requested
|
|
|
|
|
*/
|
|
|
|
|
void nl_addr(int ns, unsigned int ifi, sa_family_t af,
|
2021-10-19 09:01:27 +02:00
|
|
|
void *addr, int *prefix_len, void *addr_l)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
|
|
|
|
int set = addr && ((af == AF_INET6 && !IN6_IS_ADDR_UNSPECIFIED(addr)) ||
|
|
|
|
|
(af == AF_INET && *(uint32_t *)addr));
|
|
|
|
|
struct req_t {
|
|
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct ifaddrmsg ifa;
|
|
|
|
|
union {
|
|
|
|
|
struct {
|
|
|
|
|
struct rtattr rta_l;
|
|
|
|
|
uint32_t l;
|
|
|
|
|
struct rtattr rta_a;
|
|
|
|
|
uint32_t a;
|
|
|
|
|
} a4;
|
|
|
|
|
struct {
|
|
|
|
|
struct rtattr rta_l;
|
|
|
|
|
struct in6_addr l;
|
|
|
|
|
struct rtattr rta_a;
|
|
|
|
|
struct in6_addr a;
|
|
|
|
|
} a6;
|
2021-10-21 04:26:08 +02:00
|
|
|
} set;
|
2021-10-11 12:01:31 +02:00
|
|
|
} req = {
|
|
|
|
|
.nlh.nlmsg_type = set ? RTM_NEWADDR : RTM_GETADDR,
|
|
|
|
|
.nlh.nlmsg_flags = NLM_F_REQUEST,
|
|
|
|
|
.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifaddrmsg)),
|
|
|
|
|
.nlh.nlmsg_seq = nl_seq++,
|
|
|
|
|
|
|
|
|
|
.ifa.ifa_family = af,
|
|
|
|
|
.ifa.ifa_index = ifi,
|
2021-10-19 09:01:27 +02:00
|
|
|
.ifa.ifa_prefixlen = *prefix_len,
|
2021-10-11 12:01:31 +02:00
|
|
|
};
|
|
|
|
|
struct ifaddrmsg *ifa;
|
|
|
|
|
struct nlmsghdr *nh;
|
|
|
|
|
struct rtattr *rta;
|
|
|
|
|
char buf[BUFSIZ];
|
2022-04-05 07:10:30 +02:00
|
|
|
ssize_t n;
|
|
|
|
|
size_t na;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
|
|
|
|
if (set) {
|
|
|
|
|
if (af == AF_INET6) {
|
2021-10-21 20:14:52 +02:00
|
|
|
size_t rta_len = RTA_LENGTH(sizeof(req.set.a6.l));
|
2021-10-21 04:26:08 +02:00
|
|
|
|
2022-10-11 00:36:30 +02:00
|
|
|
/* By default, strictly speaking, it's duplicated */
|
|
|
|
|
req.ifa.ifa_flags = IFA_F_NODAD;
|
|
|
|
|
|
2022-09-28 06:33:27 +02:00
|
|
|
req.nlh.nlmsg_len = offsetof(struct req_t, set.a6)
|
|
|
|
|
+ sizeof(req.set.a6);
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2021-10-21 04:26:08 +02:00
|
|
|
memcpy(&req.set.a6.l, addr, sizeof(req.set.a6.l));
|
|
|
|
|
req.set.a6.rta_l.rta_len = rta_len;
|
|
|
|
|
req.set.a4.rta_l.rta_type = IFA_LOCAL;
|
|
|
|
|
memcpy(&req.set.a6.a, addr, sizeof(req.set.a6.a));
|
|
|
|
|
req.set.a6.rta_a.rta_len = rta_len;
|
|
|
|
|
req.set.a6.rta_a.rta_type = IFA_ADDRESS;
|
2021-10-11 12:01:31 +02:00
|
|
|
} else {
|
2021-10-21 20:14:52 +02:00
|
|
|
size_t rta_len = RTA_LENGTH(sizeof(req.set.a4.l));
|
2021-10-21 04:26:08 +02:00
|
|
|
|
2022-09-28 06:33:27 +02:00
|
|
|
req.nlh.nlmsg_len = offsetof(struct req_t, set.a4)
|
|
|
|
|
+ sizeof(req.set.a4);
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2021-10-21 04:26:08 +02:00
|
|
|
req.set.a4.l = req.set.a4.a = *(uint32_t *)addr;
|
|
|
|
|
req.set.a4.rta_l.rta_len = rta_len;
|
|
|
|
|
req.set.a4.rta_l.rta_type = IFA_LOCAL;
|
|
|
|
|
req.set.a4.rta_a.rta_len = rta_len;
|
|
|
|
|
req.set.a4.rta_a.rta_type = IFA_ADDRESS;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
req.ifa.ifa_scope = RT_SCOPE_UNIVERSE;
|
|
|
|
|
req.nlh.nlmsg_flags |= NLM_F_CREATE | NLM_F_ACK | NLM_F_EXCL;
|
|
|
|
|
} else {
|
|
|
|
|
req.nlh.nlmsg_flags |= NLM_F_DUMP;
|
|
|
|
|
}
|
|
|
|
|
|
2022-05-01 06:55:49 +02:00
|
|
|
if ((n = nl_req(ns, buf, &req, req.nlh.nlmsg_len)) < 0 || set)
|
2021-10-11 12:01:31 +02:00
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
nh = (struct nlmsghdr *)buf;
|
|
|
|
|
for ( ; NLMSG_OK(nh, n); nh = NLMSG_NEXT(nh, n)) {
|
|
|
|
|
if (nh->nlmsg_type != RTM_NEWADDR)
|
|
|
|
|
goto next;
|
|
|
|
|
|
|
|
|
|
ifa = (struct ifaddrmsg *)NLMSG_DATA(nh);
|
2021-10-19 09:08:06 +02:00
|
|
|
if (ifa->ifa_index != ifi)
|
|
|
|
|
goto next;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2021-10-20 00:05:11 +02:00
|
|
|
for (rta = IFA_RTA(ifa), na = RTM_PAYLOAD(nh); RTA_OK(rta, na);
|
|
|
|
|
rta = RTA_NEXT(rta, na)) {
|
2021-10-11 12:01:31 +02:00
|
|
|
if (rta->rta_type != IFA_ADDRESS)
|
|
|
|
|
continue;
|
|
|
|
|
|
2021-10-19 09:01:27 +02:00
|
|
|
if (af == AF_INET && addr && !*(uint32_t *)addr) {
|
2021-10-11 12:01:31 +02:00
|
|
|
memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta));
|
2021-10-19 09:01:27 +02:00
|
|
|
*prefix_len = ifa->ifa_prefixlen;
|
|
|
|
|
} else if (af == AF_INET6 && addr &&
|
2021-10-11 12:01:31 +02:00
|
|
|
ifa->ifa_scope == RT_SCOPE_UNIVERSE &&
|
2021-10-19 09:01:27 +02:00
|
|
|
IN6_IS_ADDR_UNSPECIFIED(addr)) {
|
2021-10-11 12:01:31 +02:00
|
|
|
memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta));
|
2021-10-19 09:01:27 +02:00
|
|
|
}
|
2021-10-11 12:01:31 +02:00
|
|
|
|
|
|
|
|
if (addr_l &&
|
|
|
|
|
af == AF_INET6 && ifa->ifa_scope == RT_SCOPE_LINK &&
|
|
|
|
|
IN6_IS_ADDR_UNSPECIFIED(addr_l))
|
|
|
|
|
memcpy(addr_l, RTA_DATA(rta), RTA_PAYLOAD(rta));
|
|
|
|
|
}
|
|
|
|
|
next:
|
|
|
|
|
if (nh->nlmsg_type == NLMSG_DONE)
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_link() - Get/set link attributes
|
|
|
|
|
* @ns: Use netlink socket in namespace
|
|
|
|
|
* @ifi: Interface index
|
|
|
|
|
* @mac: MAC address to fill, if passed as zero, to set otherwise
|
|
|
|
|
* @up: If set, bring up the link
|
2021-10-14 13:05:56 +02:00
|
|
|
* @mtu: If non-zero, set interface MTU
|
2021-10-11 12:01:31 +02:00
|
|
|
*/
|
2021-10-14 13:05:56 +02:00
|
|
|
void nl_link(int ns, unsigned int ifi, void *mac, int up, int mtu)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
2021-10-14 13:05:56 +02:00
|
|
|
int change = !MAC_IS_ZERO(mac) || up || mtu;
|
2022-02-23 10:50:09 +01:00
|
|
|
struct req_t {
|
2021-10-11 12:01:31 +02:00
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct ifinfomsg ifm;
|
|
|
|
|
struct rtattr rta;
|
2021-10-14 13:05:56 +02:00
|
|
|
union {
|
|
|
|
|
unsigned char mac[ETH_ALEN];
|
2022-02-23 10:50:09 +01:00
|
|
|
struct {
|
|
|
|
|
unsigned int mtu;
|
|
|
|
|
} mtu;
|
2021-10-21 04:26:08 +02:00
|
|
|
} set;
|
2021-10-11 12:01:31 +02:00
|
|
|
} req = {
|
2021-10-14 13:05:56 +02:00
|
|
|
.nlh.nlmsg_type = change ? RTM_NEWLINK : RTM_GETLINK,
|
|
|
|
|
.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg)),
|
|
|
|
|
.nlh.nlmsg_flags = NLM_F_REQUEST | (change ? NLM_F_ACK : 0),
|
|
|
|
|
.nlh.nlmsg_seq = nl_seq++,
|
|
|
|
|
.ifm.ifi_family = AF_UNSPEC,
|
|
|
|
|
.ifm.ifi_index = ifi,
|
|
|
|
|
.ifm.ifi_flags = up ? IFF_UP : 0,
|
|
|
|
|
.ifm.ifi_change = up ? IFF_UP : 0,
|
2021-10-11 12:01:31 +02:00
|
|
|
};
|
|
|
|
|
struct ifinfomsg *ifm;
|
|
|
|
|
struct nlmsghdr *nh;
|
|
|
|
|
struct rtattr *rta;
|
|
|
|
|
char buf[BUFSIZ];
|
2022-04-05 07:10:30 +02:00
|
|
|
ssize_t n;
|
|
|
|
|
size_t na;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
|
|
|
|
if (!MAC_IS_ZERO(mac)) {
|
|
|
|
|
req.nlh.nlmsg_len = sizeof(req);
|
2021-10-21 04:26:08 +02:00
|
|
|
memcpy(req.set.mac, mac, ETH_ALEN);
|
2021-10-14 13:05:56 +02:00
|
|
|
req.rta.rta_type = IFLA_ADDRESS;
|
|
|
|
|
req.rta.rta_len = RTA_LENGTH(ETH_ALEN);
|
2022-04-05 07:10:30 +02:00
|
|
|
if (nl_req(ns, buf, &req, req.nlh.nlmsg_len) < 0)
|
|
|
|
|
return;
|
|
|
|
|
|
2021-10-14 19:11:05 +02:00
|
|
|
up = 0;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
2021-10-14 13:05:56 +02:00
|
|
|
if (mtu) {
|
2022-09-28 06:33:27 +02:00
|
|
|
req.nlh.nlmsg_len = offsetof(struct req_t, set.mtu)
|
|
|
|
|
+ sizeof(req.set.mtu);
|
2022-02-23 10:50:09 +01:00
|
|
|
req.set.mtu.mtu = mtu;
|
2021-10-14 13:05:56 +02:00
|
|
|
req.rta.rta_type = IFLA_MTU;
|
|
|
|
|
req.rta.rta_len = RTA_LENGTH(sizeof(unsigned int));
|
2022-04-05 07:10:30 +02:00
|
|
|
if (nl_req(ns, buf, &req, req.nlh.nlmsg_len) < 0)
|
|
|
|
|
return;
|
|
|
|
|
|
2021-10-14 19:11:05 +02:00
|
|
|
up = 0;
|
2021-10-14 13:05:56 +02:00
|
|
|
}
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2022-04-05 07:10:30 +02:00
|
|
|
if (up && nl_req(ns, buf, &req, req.nlh.nlmsg_len) < 0)
|
|
|
|
|
return;
|
2021-10-14 19:11:05 +02:00
|
|
|
|
2021-10-14 13:05:56 +02:00
|
|
|
if (change)
|
2021-10-11 12:01:31 +02:00
|
|
|
return;
|
|
|
|
|
|
2022-04-05 07:10:30 +02:00
|
|
|
if ((n = nl_req(ns, buf, &req, req.nlh.nlmsg_len)) < 0)
|
|
|
|
|
return;
|
2021-10-14 13:05:56 +02:00
|
|
|
|
2021-10-11 12:01:31 +02:00
|
|
|
nh = (struct nlmsghdr *)buf;
|
|
|
|
|
for ( ; NLMSG_OK(nh, n); nh = NLMSG_NEXT(nh, n)) {
|
|
|
|
|
if (nh->nlmsg_type != RTM_NEWLINK)
|
|
|
|
|
goto next;
|
|
|
|
|
|
|
|
|
|
ifm = (struct ifinfomsg *)NLMSG_DATA(nh);
|
|
|
|
|
|
2021-10-20 00:05:11 +02:00
|
|
|
for (rta = IFLA_RTA(ifm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na);
|
|
|
|
|
rta = RTA_NEXT(rta, na)) {
|
2021-10-11 12:01:31 +02:00
|
|
|
if (rta->rta_type != IFLA_ADDRESS)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
memcpy(mac, RTA_DATA(rta), ETH_ALEN);
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
next:
|
|
|
|
|
if (nh->nlmsg_type == NLMSG_DONE)
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|