container: T7736: give container veths a deterministic host_interface_name

Podman's default "vethN" auto-naming for a container's host-side veth can
collide with VyOS's own "virtual-ethernet vethN" interfaces.

Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name"
network connect option) and use it to name every non-macvlan container network
attachment "veth-<container name>" instead, eliminating the collision by
construction.

Author: c-po

debian/control

@@ -332,7 +332,7 @@ Depends:
   kbd,
 # End "system option keyboard-layout"
 # For "container"
-  podman (>=4.9.5),
+  podman (>=5.8),
   netavark,
   aardvark-dns,
 # iptables is only used for containers now, not the the firewall CLI

smoketest/scripts/cli/test_container.py

@@ -264,6 +264,33 @@ def test_user_defined_mac(self):
         n = cmd_to_json(['container', 'inspect', 'test2'])
         self.assertEqual(n['NetworkSettings']['Networks']['bridge1']['MacAddress'], '02:00:00:00:00:02')
 
+    def test_long_name_host_interface_uniqueness(self):
+        # T7736: the deterministic host-side veth interface name derived
+        # from a container name is truncated to fit IFNAMSIZ. Two distinct
+        # but similarly-prefixed long names must not truncate to the same
+        # interface name - Podman would then refuse to attach the second
+        # container's network, and its systemd unit would fail to start.
+        net_name = 'longiftest'
+        prefix = '192.0.2.0/24'
+        name_1 = 'abcdefghij-1'
+        name_2 = 'abcdefghij-2'
+
+        self.cli_set(base_path + ['network', net_name, 'prefix', prefix])
+        self.cli_set(base_path + ['name', name_1, 'image', busybox_image])
+        self.cli_set(base_path + ['name', name_1, 'network', net_name, 'address', str(ip_interface(prefix).ip + 2)])
+        self.cli_set(base_path + ['name', name_2, 'image', busybox_image])
+        self.cli_set(base_path + ['name', name_2, 'network', net_name, 'address', str(ip_interface(prefix).ip + 3)])
+        self.cli_commit()
+
+        # Both containers run a "conmon" process at once, so checking by
+        # process name alone can't distinguish which container it belongs
+        # to - verify each container's own recorded PID is still alive
+        for name in (name_1, name_2):
+            pid = 0
+            with open(PROCESS_PIDFILE.format(name)) as f:
+                pid = int(f.read())
+            self.assertTrue(os.path.exists(f'/proc/{pid}'))
+
     def test_ipv4_network(self):
         prefix = '192.0.2.0/24'
         base_name = 'ipv4'

src/conf_mode/container.py

@@ -122,6 +122,7 @@ def verify(container):
         net_dict = {}
         net_dict['mac'] = {}
         net_dict['address'] = {}
+        net_dict['host_ifname'] = {}
 
         for name, container_config in container['name'].items():
             # Container image is a mandatory option
@@ -158,6 +159,19 @@ def verify(container):
                 if network_name not in container.get('network', {}):
                     raise ConfigError(f'Container network "{network_name}" does not exist!')
 
+                # T7736: two distinct (long) container names could truncate
+                # to the same host_interface_name - not applicable to
+                # macvlan networks, they attach without a paired host veth
+                network_type = dict_search(f'{network_name}.type', container['network'])
+                if dict_search('macvlan', network_type) is None:
+                    host_ifname = get_container_host_ifname(name)
+                    if host_ifname in net_dict['host_ifname']:
+                        raise ConfigError(
+                            f'Container "{name}" and "{net_dict["host_ifname"][host_ifname]}" '
+                            f'both generate the host interface name "{host_ifname}" - please '
+                            f'use less similar container names!')
+                    net_dict['host_ifname'][host_ifname] = name
+
                 if 'name_server' in container_config and 'no_name_server' not in container['network'][network_name]:
                     raise ConfigError(f'Setting name server has no effect when attached container network has DNS enabled!')
 
@@ -361,7 +375,28 @@ def verify(container):
     return None
 
 
-def generate_run_arguments(name, container_config, host_ident):
+def get_container_host_ifname(name: str) -> str:
+    """
+    Deterministic host-side veth interface name for a container's network
+    attachment (verify() only allows one network per container). Kept
+    within IFNAMSIZ (15 usable characters) and - thanks to the leading
+    "veth-" (a hyphen can never appear in a VyOS "vethN" interface name) -
+    guaranteed to never collide with the VyOS "virtual-ethernet" naming
+    scheme - T7736.
+
+    Container names are unbounded in length, so a name longer than fits is
+    truncated - a short hash of the full name is appended so two distinct
+    long names can never truncate to the same interface name; verify()
+    additionally rejects any resulting duplicate.
+    """
+    prefix = f'veth-{name}'
+    if len(prefix) <= 15:
+        return prefix
+    digest = sha256(name.encode()).hexdigest()[:4]
+    return f'veth-{name[:5]}-{digest}'
+
+
+def generate_run_arguments(name, container_config, host_ident, network_config):
     image = container_config['image']
     cpu_quota = container_config['cpu_quota']
     memory = container_config['memory']
@@ -511,9 +546,21 @@ def generate_run_arguments(name, container_config, host_ident):
     else:
         ip_param = ''
         addr_info = ''
-        networks = ",".join(container_config['network'])
+        network_opts = []
         for network in container_config['network']:
             network_name = network
+            # T7736: give the host-side veth a name that can never collide
+            # with a VyOS "virtual-ethernet vethN" interface, instead of
+            # leaving it to Podman's own "vethN" auto-naming. Not applicable
+            # to macvlan networks - they attach without a paired host veth.
+            type_config = dict_search(f'{network}.type', network_config)
+            is_macvlan = dict_search('macvlan', type_config) is not None
+            net_opt = network
+            if not is_macvlan:
+                ifname = get_container_host_ifname(name)
+                net_opt += f':host_interface_name={ifname}'
+            network_opts.append(net_opt)
+
             if 'address' not in container_config['network'][network]:
                 continue
             for address in container_config['network'][network]['address']:
@@ -524,6 +571,8 @@ def generate_run_arguments(name, container_config, host_ident):
 
             addr_info = ''.join(container_config['network'][network]['address'])
 
+        networks = ' '.join(f'--network {opt}' for opt in network_opts)
+
         get_mac = dict_search(f'network.{network_name}.mac', container_config)
         if get_mac == 'auto' or get_mac is None:
             mac_add = gen_mac(name, addr_info, host_ident)
@@ -546,7 +595,7 @@ def generate_run_arguments(name, container_config, host_ident):
             delete_cli_node(mac_config_path)
             add_cli_node(mac_config_path, value=mac_add)
 
-        net = f'--net {networks} {ip_param} {mac_address}'
+        net = f'{networks} {ip_param} {mac_address}'
 
     return f'{container_base_cmd} {healthcheck} {net} {entrypoint} {image} {command} {command_arguments}'.strip()
 
@@ -626,12 +675,13 @@ def generate(container):
 
     if 'name' in container:
         host_ident = get_host_identity()
+        network_config = container.get('network', {})
         for name, container_config in container['name'].items():
             if 'disable' in container_config:
                 continue
 
             file_path = os.path.join(systemd_unit_path, f'vyos-container-{name}.service')
-            run_args = generate_run_arguments(name, container_config, host_ident)
+            run_args = generate_run_arguments(name, container_config, host_ident, network_config)
             render(file_path, 'container/systemd-unit.j2', {'name': name, 'run_args': run_args, },
                    formatter=lambda _: _.replace("&quot;", '"').replace("&apos;", "'"))