#include <net/if.h>

#include <net/if_arp.h>

#include "alloc-util.h"

#include "firewall-util.h"

#include "memory-util.h"

#include "netlink-util.h"

#include "networkd-address-pool.h"

#include "networkd-address.h"

#include "networkd-dhcp-server.h"

#include "networkd-ipv4acd.h"

#include "networkd-manager.h"

#include "networkd-network.h"

#include "networkd-queue.h"

#include "networkd-route-util.h"

#include "networkd-route.h"

#include "parse-util.h"

#include "string-util.h"

#include "strv.h"

#include "strxcpyx.h"

#define ADDRESSES_PER_LINK_MAX 2048U

#define STATIC_ADDRESSES_PER_NETWORK_MAX 1024U

int address_flags_to_string_alloc(uint32_t flags, int family, char **ret) {

_cleanup_free_ char *str = NULL;

static const char* map[] = {

[LOG2U(IFA_F_SECONDARY)] = "secondary", /* This is also called "temporary" for ipv6. */

[LOG2U(IFA_F_NODAD)] = "nodad",

[LOG2U(IFA_F_OPTIMISTIC)] = "optimistic",

[LOG2U(IFA_F_DADFAILED)] = "dadfailed",

[LOG2U(IFA_F_HOMEADDRESS)] = "home-address",

[LOG2U(IFA_F_DEPRECATED)] = "deprecated",

[LOG2U(IFA_F_TENTATIVE)] = "tentative",

[LOG2U(IFA_F_PERMANENT)] = "permanent",

[LOG2U(IFA_F_MANAGETEMPADDR)] = "manage-temporary-address",

[LOG2U(IFA_F_NOPREFIXROUTE)] = "no-prefixroute",

[LOG2U(IFA_F_MCAUTOJOIN)] = "auto-join",

[LOG2U(IFA_F_STABLE_PRIVACY)] = "stable-privacy",

};

assert(IN_SET(family, AF_INET, AF_INET6));

assert(ret);

for (size_t i = 0; i < ELEMENTSOF(map); i++)

if (FLAGS_SET(flags, 1 << i) && map[i])

if (!strextend_with_separator(

&str, ",",

family == AF_INET6 && (1 << i) == IFA_F_SECONDARY ? "temporary" : map[i]))

return -ENOMEM;

*ret = TAKE_PTR(str);

return 0;

}

int address_new(Address **ret) {

_cleanup_(address_freep) Address *address = NULL;

address = new(Address, 1);

if (!address)

return -ENOMEM;

*address = (Address) {

.family = AF_UNSPEC,

.scope = RT_SCOPE_UNIVERSE,

.lifetime_valid_usec = USEC_INFINITY,

.lifetime_preferred_usec = USEC_INFINITY,

.set_broadcast = -1,

};

*ret = TAKE_PTR(address);

return 0;

}

static int address_new_static(Network *network, const char *filename, unsigned section_line, Address **ret) {

_cleanup_(config_section_freep) ConfigSection *n = NULL;

_cleanup_(address_freep) Address *address = NULL;

int r;

assert(network);

assert(ret);

assert(filename);

assert(section_line > 0);

r = config_section_new(filename, section_line, &n);

if (r < 0)

return r;

address = ordered_hashmap_get(network->addresses_by_section, n);

if (address) {

*ret = TAKE_PTR(address);

return 0;

}

if (ordered_hashmap_size(network->addresses_by_section) >= STATIC_ADDRESSES_PER_NETWORK_MAX)

return -E2BIG;

r = address_new(&address);

if (r < 0)

return r;

address->network = network;

address->section = TAKE_PTR(n);

address->source = NETWORK_CONFIG_SOURCE_STATIC;

/* This will be adjusted in address_section_verify(). */

address->duplicate_address_detection = _ADDRESS_FAMILY_INVALID;

r = ordered_hashmap_ensure_put(&network->addresses_by_section, &config_section_hash_ops, address->section, address);

if (r < 0)

return r;

*ret = TAKE_PTR(address);

return 0;

}

Address *address_free(Address *address) {

if (!address)

return NULL;

if (address->network) {

assert(address->section);

ordered_hashmap_remove(address->network->addresses_by_section, address->section);

}

if (address->link) {

set_remove(address->link->addresses, address);

if (address->family == AF_INET6 &&

in6_addr_equal(&address->in_addr.in6, &address->link->ipv6ll_address))

memzero(&address->link->ipv6ll_address, sizeof(struct in6_addr));

}

sd_ipv4acd_unref(address->acd);

config_section_free(address->section);

free(address->label);

return mfree(address);

}

bool address_is_ready(const Address *a) {

assert(a);

if (FLAGS_SET(a->flags, IFA_F_TENTATIVE))

return false;

if (FLAGS_SET(a->state, NETWORK_CONFIG_STATE_REMOVING))

return false;

if (FLAGS_SET(a->state, NETWORK_CONFIG_STATE_PROBING))

return false;

if (!FLAGS_SET(a->state, NETWORK_CONFIG_STATE_CONFIGURED))

return false;

return true;

}

void link_mark_addresses(Link *link, NetworkConfigSource source, const struct in6_addr *router) {

Address *a;

assert(link);

SET_FOREACH(a, link->addresses) {

if (a->source != source)

continue;

if (source == NETWORK_CONFIG_SOURCE_NDISC &&

router && !in6_addr_equal(router, &a->provider.in6))

continue;

address_mark(a);

}

}

static bool address_needs_to_set_broadcast(const Address *a, Link *link) {

assert(a);

assert(link);

if (a->family != AF_INET)

return false;

if (in4_addr_is_set(&a->in_addr_peer.in))

return false;

/* A /31 or /32 IPv4 address does not have a broadcast address.

if (a->prefixlen > 30)

return false;

/* If explicitly configured, do not update the address. */

if (in4_addr_is_set(&a->broadcast))

return false;

if (a->set_broadcast >= 0)

return a->set_broadcast;

/* Defaults to true, except for wireguard, as typical configuration for wireguard does not set

return !streq_ptr(link->kind, "wireguard");

}

void address_set_broadcast(Address *a, Link *link) {

assert(a);

assert(link);

if (!address_needs_to_set_broadcast(a, link))

return;

a->broadcast.s_addr = a->in_addr.in.s_addr | htobe32(UINT32_C(0xffffffff) >> a->prefixlen);

}

static struct ifa_cacheinfo *address_set_cinfo(const Address *a, struct ifa_cacheinfo *cinfo) {

usec_t now_usec;

assert(a);

assert(cinfo);

now_usec = now(CLOCK_BOOTTIME);

*cinfo = (struct ifa_cacheinfo) {

.ifa_valid = MIN(usec_sub_unsigned(a->lifetime_valid_usec, now_usec) / USEC_PER_SEC, UINT32_MAX),

.ifa_prefered = MIN(usec_sub_unsigned(a->lifetime_preferred_usec, now_usec) / USEC_PER_SEC, UINT32_MAX),

};

return cinfo;

}

static void address_set_lifetime(Address *a, const struct ifa_cacheinfo *cinfo) {

usec_t now_usec;

assert(a);

assert(cinfo);

now_usec = now(CLOCK_BOOTTIME);

if (cinfo->ifa_valid == UINT32_MAX)

a->lifetime_valid_usec = USEC_INFINITY;

else

a->lifetime_valid_usec = usec_add(cinfo->ifa_valid * USEC_PER_SEC, now_usec);

if (cinfo->ifa_prefered == UINT32_MAX)

a->lifetime_preferred_usec = USEC_INFINITY;

else

a->lifetime_preferred_usec = usec_add(cinfo->ifa_prefered * USEC_PER_SEC, now_usec);

}

static uint32_t address_prefix(const Address *a) {

assert(a);

/* make sure we don't try to shift by 32.

if (a->prefixlen == 0)

return 0;

if (a->in_addr_peer.in.s_addr != 0)

return be32toh(a->in_addr_peer.in.s_addr) >> (32 - a->prefixlen);

else

return be32toh(a->in_addr.in.s_addr) >> (32 - a->prefixlen);

}

static void address_kernel_hash_func(const Address *a, struct siphash *state) {

assert(a);

siphash24_compress(&a->family, sizeof(a->family), state);

switch (a->family) {

case AF_INET:

siphash24_compress(&a->prefixlen, sizeof(a->prefixlen), state);

uint32_t prefix = address_prefix(a);

siphash24_compress(&prefix, sizeof(prefix), state);

_fallthrough_;

case AF_INET6:

siphash24_compress(&a->in_addr, FAMILY_ADDRESS_SIZE(a->family), state);

break;

default:

/* treat any other address family as AF_UNSPEC */

break;

}

}

static int address_kernel_compare_func(const Address *a1, const Address *a2) {

int r;

r = CMP(a1->family, a2->family);

if (r != 0)

return r;

switch (a1->family) {

case AF_INET:

/* See kernel's find_matching_ifa() in net/ipv4/devinet.c */

r = CMP(a1->prefixlen, a2->prefixlen);

if (r != 0)

return r;

r = CMP(address_prefix(a1), address_prefix(a2));

if (r != 0)

return r;

_fallthrough_;

case AF_INET6:

/* See kernel's ipv6_get_ifaddr() in net/ipv6/addrconf.c */

return memcmp(&a1->in_addr, &a2->in_addr, FAMILY_ADDRESS_SIZE(a1->family));

default:

/* treat any other address family as AF_UNSPEC */

return 0;

}

}

DEFINE_PRIVATE_HASH_OPS(

address_kernel_hash_ops,

Address,

address_kernel_hash_func,

address_kernel_compare_func);

static void address_hash_func(const Address *a, struct siphash *state) {

assert(a);

siphash24_compress(&a->family, sizeof(a->family), state);

/* treat any other address family as AF_UNSPEC */

if (!IN_SET(a->family, AF_INET, AF_INET6))

return;

siphash24_compress(&a->prefixlen, sizeof(a->prefixlen), state);

siphash24_compress(&a->in_addr, FAMILY_ADDRESS_SIZE(a->family), state);

siphash24_compress(&a->in_addr_peer, FAMILY_ADDRESS_SIZE(a->family), state);

if (a->family == AF_INET) {

/* On update, the kernel ignores the address label and broadcast address, hence we need

siphash24_compress_string(a->label, state);

siphash24_compress(&a->broadcast, sizeof(a->broadcast), state);

}

}

int address_compare_func(const Address *a1, const Address *a2) {

int r;

r = CMP(a1->family, a2->family);

if (r != 0)

return r;

if (!IN_SET(a1->family, AF_INET, AF_INET6))

return 0;

r = CMP(a1->prefixlen, a2->prefixlen);

if (r != 0)

return r;

r = memcmp(&a1->in_addr, &a2->in_addr, FAMILY_ADDRESS_SIZE(a1->family));

if (r != 0)

return r;

r = memcmp(&a1->in_addr_peer, &a2->in_addr_peer, FAMILY_ADDRESS_SIZE(a1->family));

if (r != 0)

return r;

if (a1->family == AF_INET) {

r = strcmp_ptr(a1->label, a2->label);

if (r != 0)

return r;

r = CMP(a1->broadcast.s_addr, a2->broadcast.s_addr);

if (r != 0)

return r;

}

return 0;

}

DEFINE_PRIVATE_HASH_OPS_WITH_KEY_DESTRUCTOR(

address_hash_ops_free,

Address,

address_hash_func,

address_compare_func,

address_free);

int address_dup(const Address *src, Address **ret) {

_cleanup_(address_freep) Address *dest = NULL;

int r;

assert(src);

assert(ret);

dest = newdup(Address, src, 1);

if (!dest)

return -ENOMEM;

/* clear all pointers */

dest->network = NULL;

dest->section = NULL;

dest->link = NULL;

dest->label = NULL;

dest->acd = NULL;

if (src->family == AF_INET) {

r = free_and_strdup(&dest->label, src->label);

if (r < 0)

return r;

}

*ret = TAKE_PTR(dest);

return 0;

}

static int address_set_masquerade(Address *address, bool add) {

union in_addr_union masked;

int r;

assert(address);

assert(address->link);

if (!address->link->network)

return 0;

if (address->family == AF_INET &&

!FLAGS_SET(address->link->network->ip_masquerade, ADDRESS_FAMILY_IPV4))

return 0;

if (address->family == AF_INET6 &&

!FLAGS_SET(address->link->network->ip_masquerade, ADDRESS_FAMILY_IPV6))

return 0;

if (address->scope >= RT_SCOPE_LINK)

return 0;

if (address->ip_masquerade_done == add)

return 0;

masked = address->in_addr;

r = in_addr_mask(address->family, &masked, address->prefixlen);

if (r < 0)

return r;

r = fw_add_masquerade(&address->link->manager->fw_ctx, add, address->family, &masked, address->prefixlen);

if (r < 0)

return r;

address->ip_masquerade_done = add;

return 0;

}

static int address_add(Link *link, Address *address) {

int r;

assert(link);

assert(address);

r = set_ensure_put(&link->addresses, &address_hash_ops_free, address);

if (r < 0)

return r;

if (r == 0)

return -EEXIST;

address->link = link;

return 0;

}

static int address_update(Address *address) {

Link *link;

int r;

assert(address);

assert(address->link);

link = address->link;

if (address_is_ready(address) &&

address->family == AF_INET6 &&

in6_addr_is_link_local(&address->in_addr.in6) &&

in6_addr_is_null(&link->ipv6ll_address)) {

link->ipv6ll_address = address->in_addr.in6;

r = link_ipv6ll_gained(link);

if (r < 0)

return r;

}

if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))

return 0;

r = address_set_masquerade(address, true);

if (r < 0)

return log_link_warning_errno(link, r, "Could not enable IP masquerading: %m");

if (address_is_ready(address) && address->callback) {

r = address->callback(address);

if (r < 0)

return r;

}

link_update_operstate(link, true);

link_check_ready(link);

return 0;

}

static int address_drop(Address *address) {

Link *link;

bool ready;

int r;

assert(address);

assert(address->link);

ready = address_is_ready(address);

link = address->link;

r = address_set_masquerade(address, false);

if (r < 0)

log_link_warning_errno(link, r, "Failed to disable IP masquerading, ignoring: %m");

if (address->state == 0)

address_free(address);

link_update_operstate(link, true);

if (link && !ready)

link_check_ready(link);

return 0;

}

int address_get(Link *link, const Address *in, Address **ret) {

Address *existing;

assert(link);

assert(in);

existing = set_get(link->addresses, in);

if (!existing)

return -ENOENT;

if (ret)

*ret = existing;

return 0;

}

int link_get_address(Link *link, int family, const union in_addr_union *address, unsigned char prefixlen, Address **ret) {

Address *a;

int r;

assert(link);

assert(IN_SET(family, AF_INET, AF_INET6));

assert(address);

/* This find an Address object on the link which matches the given address and prefix length

if (prefixlen != 0) {

_cleanup_(address_freep) Address *tmp = NULL;

/* If prefixlen is set, then we can use address_get(). */

r = address_new(&tmp);

if (r < 0)

return r;

tmp->family = family;

tmp->in_addr = *address;

tmp->prefixlen = prefixlen;

address_set_broadcast(tmp, link);

if (address_get(link, tmp, &a) >= 0) {

if (ret)

*ret = a;

return 0;

}

if (family == AF_INET6)

return -ENOENT;

/* IPv4 addresses may have label and/or non-default broadcast address.

}

SET_FOREACH(a, link->addresses) {

if (a->family != family)

continue;

if (!in_addr_equal(family, &a->in_addr, address))

continue;

if (in_addr_is_set(family, &a->in_addr_peer))

continue;

if (ret)

*ret = a;

return 0;

}

return -ENOENT;

}

int manager_get_address(Manager *manager, int family, const union in_addr_union *address, unsigned char prefixlen, Address **ret) {

Link *link;

assert(manager);

assert(IN_SET(family, AF_INET, AF_INET6));

assert(address);

HASHMAP_FOREACH(link, manager->links_by_index) {

if (!IN_SET(link->state, LINK_STATE_CONFIGURING, LINK_STATE_CONFIGURED))

continue;

if (link_get_address(link, family, address, prefixlen, ret) >= 0)

return 0;

}

return -ENOENT;

}

bool manager_has_address(Manager *manager, int family, const union in_addr_union *address, bool check_ready) {

Address *a;

assert(manager);

assert(IN_SET(family, AF_INET, AF_INET6));

assert(address);

if (manager_get_address(manager, family, address, 0, &a) < 0)

return false;

return check_ready ? address_is_ready(a) : address_exists(a);

}

const char* format_lifetime(char *buf, size_t l, usec_t lifetime_usec) {

assert(buf);

assert(l > 4);

if (lifetime_usec == USEC_INFINITY)

return "forever";

sprintf(buf, "for ");

/* format_timespan() never fails */

assert_se(format_timespan(buf + 4, l - 4, usec_sub_unsigned(lifetime_usec, now(CLOCK_BOOTTIME)), USEC_PER_SEC));

return buf;

}

static void log_address_debug(const Address *address, const char *str, const Link *link) {

_cleanup_free_ char *state = NULL, *addr = NULL, *peer = NULL, *flags_str = NULL, *scope_str = NULL;

assert(address);

assert(str);

assert(link);

if (!DEBUG_LOGGING)

return;

(void) network_config_state_to_string_alloc(address->state, &state);

(void) in_addr_to_string(address->family, &address->in_addr, &addr);

if (in_addr_is_set(address->family, &address->in_addr_peer))

(void) in_addr_to_string(address->family, &address->in_addr_peer, &peer);

(void) address_flags_to_string_alloc(address->flags, address->family, &flags_str);

(void) route_scope_to_string_alloc(address->scope, &scope_str);

log_link_debug(link, "%s %s address (%s): %s%s%s/%u (valid %s, preferred %s), flags: %s, scope: %s",

str, strna(network_config_source_to_string(address->source)), strna(state),

strnull(addr), peer ? " peer " : "", strempty(peer), address->prefixlen,

FORMAT_LIFETIME(address->lifetime_valid_usec),

FORMAT_LIFETIME(address->lifetime_preferred_usec),

strna(flags_str), strna(scope_str));

}

static int address_set_netlink_message(const Address *address, sd_netlink_message *m, Link *link) {

uint32_t flags;

int r;

assert(address);

assert(m);

assert(link);

r = sd_rtnl_message_addr_set_prefixlen(m, address->prefixlen);

if (r < 0)

return r;

/* On remove, only IFA_F_MANAGETEMPADDR flag for IPv6 addresses are used. But anyway, set all

flags = address->flags & ~IFA_F_TENTATIVE;

r = sd_rtnl_message_addr_set_flags(m, flags & 0xff);

if (r < 0)

return r;

if ((flags & ~0xff) != 0) {

r = sd_netlink_message_append_u32(m, IFA_FLAGS, flags);

if (r < 0)

return r;

}

r = netlink_message_append_in_addr_union(m, IFA_LOCAL, address->family, &address->in_addr);

if (r < 0)

return r;

return 0;

}

static int address_remove_handler(sd_netlink *rtnl, sd_netlink_message *m, Link *link) {

int r;

assert(m);

assert(link);

if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))

return 0;

r = sd_netlink_message_get_errno(m);

if (r < 0 && r != -EADDRNOTAVAIL)

log_link_message_warning_errno(link, m, r, "Could not drop address");

return 1;

}

int address_remove(Address *address) {

_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;

Link *link;

int r;

assert(address);

assert(IN_SET(address->family, AF_INET, AF_INET6));

assert(address->link);

assert(address->link->ifindex > 0);

assert(address->link->manager);

assert(address->link->manager->rtnl);

link = address->link;

log_address_debug(address, "Removing", link);

r = sd_rtnl_message_new_addr(link->manager->rtnl, &m, RTM_DELADDR,

link->ifindex, address->family);

if (r < 0)

return log_link_warning_errno(link, r, "Could not allocate RTM_DELADDR message: %m");

r = address_set_netlink_message(address, m, link);

if (r < 0)

return log_link_warning_errno(link, r, "Could not set netlink attributes: %m");

r = netlink_call_async(link->manager->rtnl, NULL, m,

address_remove_handler,

link_netlink_destroy_callback, link);

if (r < 0)

return log_link_warning_errno(link, r, "Could not send rtnetlink message: %m");

link_ref(link);

address_enter_removing(address);

/* The operational state is determined by address state and carrier state. Hence, if we remove

link_update_operstate(link, true);

return 0;

}

bool link_address_is_dynamic(const Link *link, const Address *address) {

Route *route;

assert(link);

assert(address);

if (address->lifetime_preferred_usec != USEC_INFINITY)

return true;

/* Even when the address is leased from a DHCP server, networkd assign the address

SET_FOREACH(route, link->routes) {

if (route->source != NETWORK_CONFIG_SOURCE_FOREIGN)

continue;

/* The route is not assigned yet, or already removed. Ignoring. */

if (!route_exists(route))

continue;

if (route->protocol != RTPROT_DHCP)

continue;

if (address->family != route->family)

continue;

if (in_addr_equal(address->family, &address->in_addr, &route->prefsrc))

return true;

}

return false;

}

int link_drop_ipv6ll_addresses(Link *link) {

_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL, *reply = NULL;

int r;

assert(link);

assert(link->manager);

assert(link->manager->rtnl);

/* IPv6LL address may be in the tentative state, and in that case networkd has not received it.

if (link_may_have_ipv6ll(link))

return 0;

r = sd_rtnl_message_new_addr(link->manager->rtnl, &req, RTM_GETADDR, link->ifindex, AF_INET6);

if (r < 0)

return r;

r = sd_netlink_message_request_dump(req, true);

if (r < 0)

return r;

r = sd_netlink_call(link->manager->rtnl, req, 0, &reply);

if (r < 0)

return r;

for (sd_netlink_message *addr = reply; addr; addr = sd_netlink_message_next(addr)) {

_cleanup_(address_freep) Address *a = NULL;

unsigned char flags, prefixlen;

struct in6_addr address;

Address *existing;

int ifindex;

/* NETLINK_GET_STRICT_CHK socket option is supported since kernel 4.20. To support

r = sd_rtnl_message_addr_get_ifindex(addr, &ifindex);

if (r < 0) {

log_link_debug_errno(link, r, "rtnl: received address message without valid ifindex, ignoring: %m");

continue;

} else if (link->ifindex != ifindex)

continue;

r = sd_rtnl_message_addr_get_flags(addr, &flags);

if (r < 0) {

log_link_debug_errno(link, r, "rtnl: received address message without valid flags, ignoring: %m");

continue;

}

r = sd_rtnl_message_addr_get_prefixlen(addr, &prefixlen);

if (r < 0) {

log_link_debug_errno(link, r, "rtnl: received address message without prefixlen, ignoring: %m");

continue;

}

if (sd_netlink_message_read_in6_addr(addr, IFA_LOCAL, NULL) >= 0)

/* address with peer, ignoring. */

continue;

r = sd_netlink_message_read_in6_addr(addr, IFA_ADDRESS, &address);

if (r < 0) {

log_link_debug_errno(link, r, "rtnl: received address message without valid address, ignoring: %m");

continue;

}

if (!in6_addr_is_link_local(&address))

continue;

r = address_new(&a);

if (r < 0)

return -ENOMEM;

a->family = AF_INET6;

a->in_addr.in6 = address;

a->prefixlen = prefixlen;

a->flags = flags;

if (address_get(link, a, &existing) < 0) {

r = address_add(link, a);

if (r < 0)

return r;

existing = TAKE_PTR(a);

}

r = address_remove(existing);

if (r < 0)

return r;

}

return 0;

}

int link_drop_foreign_addresses(Link *link) {

Address *address;

int k, r = 0;

assert(link);

assert(link->network);

/* First, mark all addresses. */

SET_FOREACH(address, link->addresses) {

/* We consider IPv6LL addresses to be managed by the kernel, or dropped in link_drop_ipv6ll_addresses() */

if (address->family == AF_INET6 && in6_addr_is_link_local(&address->in_addr.in6))

continue;

/* Do not remove localhost address (127.0.0.1 and ::1) */

if (link->flags & IFF_LOOPBACK && in_addr_is_localhost_one(address->family, &address->in_addr) > 0)

continue;

/* Ignore addresses we configured. */

if (address->source != NETWORK_CONFIG_SOURCE_FOREIGN)

continue;

/* Ignore addresses not assigned yet or already removing. */

if (!address_exists(address))

continue;

/* link_address_is_dynamic() is slightly heavy. Let's call the function only when KeepConfiguration= is set. */

if (IN_SET(link->network->keep_configuration, KEEP_CONFIGURATION_DHCP, KEEP_CONFIGURATION_STATIC) &&

link_address_is_dynamic(link, address) == (link->network->keep_configuration == KEEP_CONFIGURATION_DHCP))

continue;

address_mark(address);

}

/* Then, unmark requested addresses. */

ORDERED_HASHMAP_FOREACH(address, link->network->addresses_by_section) {

Address *existing;

if (address_get(link, address, &existing) >= 0)

address_unmark(existing);

}

/* Finally, remove all marked addresses. */

SET_FOREACH(address, link->addresses) {

if (!address_is_marked(address))

continue;

k = address_remove(address);

if (k < 0 && r >= 0)

r = k;

}

return r;

}

int link_drop_managed_addresses(Link *link) {

Address *address;

int k, r = 0;

assert(link);

SET_FOREACH(address, link->addresses) {

/* Do not touch addresses managed by kernel or other tools. */

if (address->source == NETWORK_CONFIG_SOURCE_FOREIGN)

continue;

/* Ignore addresses not assigned yet or already removing. */

if (!address_exists(address))

continue;

k = address_remove(address);

if (k < 0 && r >= 0) {

r = k;

continue;

}

}

return r;

}

void link_foreignize_addresses(Link *link) {

Address *address;

assert(link);

SET_FOREACH(address, link->addresses)

address->source = NETWORK_CONFIG_SOURCE_FOREIGN;

}

static int address_acquire(Link *link, const Address *original, Address **ret) {

_cleanup_(address_freep) Address *na = NULL;

union in_addr_union in_addr;

int r;

assert(link);

assert(original);

assert(ret);

/* Something useful was configured? just use it */

if (in_addr_is_set(original->family, &original->in_addr)) {

*ret = NULL;

return 0;

}

/* The address is configured to be 0.0.0.0 or [::] by the user?

r = address_pool_acquire(link->manager, original->family, original->prefixlen, &in_addr);

if (r < 0)

return r;

if (r == 0)