peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-22 01:13:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

confd: fix veth teardown regression

Browse Source 
When a veth pair has one end in a container and the other in the host
namespace, removing it failed: the container end's teardown deleted the
whole pair, so the host end's own delete then failed ("Cannot find
device") and aborted the teardown, leaving the interface behind.

The host-namespace delete added for the both-ends-in-container case was
emitted for every container veth end.  Restrict it to the primary end,
which for a host/container pair is the host end that already deletes the
pair itself.

Extend the container veth tests to remove the pair and verify it is gone,
covering both the single-end (regression) and both-ends teardown paths.

Fixes: #1546

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2026-06-26 16:05:53 +02:00
parent 2ae1a70bac
commit ddc57ed6ae
5 changed files with 44 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/confd/src/cni.c
+8 -6
View File
@@ -415,13 +415,15 @@ int cni_netdag_gen_iface(struct dagger *net, const char *ifname,
fprintf(fp, "container -a -f delete network %s >/dev/null\n", ifname);
/* If this end belongs to a veth pair, the kernel keeps the pair
* alive after CNI host-device returns the interface to the host
* namespace. Remove it here, once the container is gone, so the
* pair does not linger and block a later re-creation. Tolerant:
* the peer's teardown may already have removed it.
/* When both ends of a veth pair are in containers, neither end
* is torn down from the host namespace, so the kernel keeps the
* pair alive after CNI host-device returns the interfaces here.
* Have the primary end delete it, once its container is gone.
* When the peer is a host interface it is the primary and deletes
* the pair itself (veth_gen_del); we must not race it here.
* Tolerant: the pair may already be gone.
*/
if (lydx_get_child(dif, "veth"))
if (lydx_get_child(dif, "veth") && veth_is_primary(dif))
fprintf(fp, "ip link del dev %s 2>/dev/null || true\n", ifname);
fclose(fp);