chiark / gitweb /
Remove dead lines in various places
[elogind.git] / src / libsystemd / sd-rtnl / rtnl-message.c
index 984115c3c0fc6413274f20938ebe7a286f53fb3e..dc749479939fc8b7d05c548f8243e23dab349c57 100644 (file)
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-#include <linux/rtnetlink.h>
 #include <netinet/in.h>
 #include <netinet/ether.h>
 #include <stdbool.h>
 #include <unistd.h>
+#include <linux/veth.h>
 
 #include "util.h"
 #include "refcnt.h"
+#include "missing.h"
 
 #include "sd-rtnl.h"
+#include "rtnl-util.h"
 #include "rtnl-internal.h"
 
-struct sd_rtnl_message {
-        RefCount n_ref;
-
-        struct nlmsghdr *hdr;
-        size_t container_offset; /* offset from hdr to container start */
-        size_t next_rta_offset; /* offset from hdr to next rta */
-
-        bool sealed:1;
-};
-
-#define CURRENT_CONTAINER(m) ((m)->container_offset ? (struct rtattr*)((uint8_t*)(m)->hdr + (m)->container_offset) : NULL)
+#define GET_CONTAINER(m, i) ((i) < (m)->n_containers ? (struct rtattr*)((uint8_t*)(m)->hdr + (m)->container_offsets[i]) : NULL)
 #define NEXT_RTA(m) ((struct rtattr*)((uint8_t*)(m)->hdr + (m)->next_rta_offset))
 #define UPDATE_RTA(m, new) (m)->next_rta_offset = (uint8_t*)(new) - (uint8_t*)(m)->hdr;
+#define PUSH_CONTAINER(m, new) (m)->container_offsets[(m)->n_containers ++] = (uint8_t*)(new) - (uint8_t*)(m)->hdr;
 
-static int message_new(sd_rtnl_message **ret, size_t initial_size) {
+int message_new(sd_rtnl *rtnl, sd_rtnl_message **ret, size_t initial_size) {
         sd_rtnl_message *m;
 
         assert_return(ret, -EINVAL);
@@ -66,86 +59,42 @@ static int message_new(sd_rtnl_message **ret, size_t initial_size) {
         m->hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
         m->sealed = false;
 
-        *ret = m;
-
-        return 0;
-}
-
-int message_new_synthetic_error(int error, uint32_t serial, sd_rtnl_message **ret) {
-        struct nlmsgerr *err;
-        int r;
-
-        assert(error <= 0);
+        if (rtnl)
+                m->rtnl = sd_rtnl_ref(rtnl);
 
-        r = message_new(ret, NLMSG_SPACE(sizeof(struct nlmsgerr)));
-        if (r < 0)
-                return r;
-
-        (*ret)->hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
-        (*ret)->hdr->nlmsg_type = NLMSG_ERROR;
-        (*ret)->hdr->nlmsg_seq = serial;
-
-        err = NLMSG_DATA((*ret)->hdr);
-
-        err->error = error;
+        *ret = m;
 
         return 0;
 }
 
-bool message_type_is_route(uint16_t type) {
-        switch (type) {
-                case RTM_NEWROUTE:
-                case RTM_GETROUTE:
-                case RTM_DELROUTE:
-                        return true;
-                default:
-                        return false;
-        }
-}
-
-bool message_type_is_link(uint16_t type) {
-        switch (type) {
-                case RTM_NEWLINK:
-                case RTM_SETLINK:
-                case RTM_GETLINK:
-                case RTM_DELLINK:
-                        return true;
-                default:
-                        return false;
-        }
-}
-
-bool message_type_is_addr(uint16_t type) {
-        switch (type) {
-                case RTM_NEWADDR:
-                case RTM_GETADDR:
-                case RTM_DELADDR:
-                        return true;
-                default:
-                        return false;
-        }
-}
-
 int sd_rtnl_message_route_set_dst_prefixlen(sd_rtnl_message *m, unsigned char prefixlen) {
         struct rtmsg *rtm;
 
+        assert_return(m, -EINVAL);
+        assert_return(m->hdr, -EINVAL);
+        assert_return(rtnl_message_type_is_route(m->hdr->nlmsg_type), -EINVAL);
+
         rtm = NLMSG_DATA(m->hdr);
 
+        if ((rtm->rtm_family == AF_INET && prefixlen > 32) ||
+            (rtm->rtm_family == AF_INET6 && prefixlen > 128))
+                return -ERANGE;
+
         rtm->rtm_dst_len = prefixlen;
 
         return 0;
 }
 
-int sd_rtnl_message_route_new(uint16_t nlmsg_type, unsigned char rtm_family,
-                              sd_rtnl_message **ret) {
+int sd_rtnl_message_new_route(sd_rtnl *rtnl, sd_rtnl_message **ret,
+                              uint16_t nlmsg_type, unsigned char rtm_family) {
         struct rtmsg *rtm;
         int r;
 
-        assert_return(message_type_is_route(nlmsg_type), -EINVAL);
+        assert_return(rtnl_message_type_is_route(nlmsg_type), -EINVAL);
         assert_return(rtm_family == AF_INET || rtm_family == AF_INET6, -EINVAL);
         assert_return(ret, -EINVAL);
 
-        r = message_new(ret, NLMSG_SPACE(sizeof(struct rtmsg)));
+        r = message_new(rtnl, ret, NLMSG_SPACE(sizeof(struct rtmsg)));
         if (r < 0)
                 return r;
 
@@ -167,13 +116,18 @@ int sd_rtnl_message_route_new(uint16_t nlmsg_type, unsigned char rtm_family,
         return 0;
 }
 
-int sd_rtnl_message_link_set_flags(sd_rtnl_message *m, unsigned flags) {
+int sd_rtnl_message_link_set_flags(sd_rtnl_message *m, unsigned flags, unsigned change) {
         struct ifinfomsg *ifi;
 
+        assert_return(m, -EINVAL);
+        assert_return(m->hdr, -EINVAL);
+        assert_return(rtnl_message_type_is_link(m->hdr->nlmsg_type), -EINVAL);
+        assert_return(change, -EINVAL);
+
         ifi = NLMSG_DATA(m->hdr);
 
         ifi->ifi_flags = flags;
-        ifi->ifi_change = 0xffffffff;
+        ifi->ifi_change = change;
 
         return 0;
 }
@@ -181,6 +135,10 @@ int sd_rtnl_message_link_set_flags(sd_rtnl_message *m, unsigned flags) {
 int sd_rtnl_message_link_set_type(sd_rtnl_message *m, unsigned type) {
         struct ifinfomsg *ifi;
 
+        assert_return(m, -EINVAL);
+        assert_return(m->hdr, -EINVAL);
+        assert_return(rtnl_message_type_is_link(m->hdr->nlmsg_type), -EINVAL);
+
         ifi = NLMSG_DATA(m->hdr);
 
         ifi->ifi_type = type;
@@ -188,15 +146,17 @@ int sd_rtnl_message_link_set_type(sd_rtnl_message *m, unsigned type) {
         return 0;
 }
 
-int sd_rtnl_message_link_new(uint16_t nlmsg_type, int index, sd_rtnl_message **ret) {
+int sd_rtnl_message_new_link(sd_rtnl *rtnl, sd_rtnl_message **ret,
+                             uint16_t nlmsg_type, int index) {
         struct ifinfomsg *ifi;
         int r;
 
-        assert_return(message_type_is_link(nlmsg_type), -EINVAL);
-        assert_return(nlmsg_type == RTM_NEWLINK || index > 0, -EINVAL);
+        assert_return(rtnl_message_type_is_link(nlmsg_type), -EINVAL);
+        assert_return(nlmsg_type == RTM_NEWLINK ||
+                      nlmsg_type == RTM_SETLINK || index > 0, -EINVAL);
         assert_return(ret, -EINVAL);
 
-        r = message_new(ret, NLMSG_SPACE(sizeof(struct ifinfomsg)));
+        r = message_new(rtnl, ret, NLMSG_SPACE(sizeof(struct ifinfomsg)));
         if (r < 0)
                 return r;
 
@@ -215,28 +175,80 @@ int sd_rtnl_message_link_new(uint16_t nlmsg_type, int index, sd_rtnl_message **r
         return 0;
 }
 
-int sd_rtnl_message_addr_new(uint16_t nlmsg_type, int index, unsigned char family, unsigned char prefixlen, unsigned char flags, unsigned char scope, sd_rtnl_message **ret) {
+int sd_rtnl_message_addr_set_prefixlen(sd_rtnl_message *m, unsigned char prefixlen) {
+        struct ifaddrmsg *ifa;
+
+        assert_return(m, -EINVAL);
+        assert_return(m->hdr, -EINVAL);
+        assert_return(rtnl_message_type_is_addr(m->hdr->nlmsg_type), -EINVAL);
+
+        ifa = NLMSG_DATA(m->hdr);
+
+        if ((ifa->ifa_family == AF_INET && prefixlen > 32) ||
+            (ifa->ifa_family == AF_INET6 && prefixlen > 128))
+                return -ERANGE;
+
+        ifa->ifa_prefixlen = prefixlen;
+
+        return 0;
+}
+
+int sd_rtnl_message_addr_set_flags(sd_rtnl_message *m, unsigned char flags) {
+        struct ifaddrmsg *ifa;
+
+        assert_return(m, -EINVAL);
+        assert_return(m->hdr, -EINVAL);
+        assert_return(rtnl_message_type_is_addr(m->hdr->nlmsg_type), -EINVAL);
+
+        ifa = NLMSG_DATA(m->hdr);
+
+        ifa->ifa_flags = flags;
+
+        return 0;
+}
+
+int sd_rtnl_message_addr_set_scope(sd_rtnl_message *m, unsigned char scope) {
+        struct ifaddrmsg *ifa;
+
+        assert_return(m, -EINVAL);
+        assert_return(m->hdr, -EINVAL);
+        assert_return(rtnl_message_type_is_addr(m->hdr->nlmsg_type), -EINVAL);
+
+        ifa = NLMSG_DATA(m->hdr);
+
+        ifa->ifa_scope = scope;
+
+        return 0;
+}
+
+int sd_rtnl_message_new_addr(sd_rtnl *rtnl, sd_rtnl_message **ret,
+                             uint16_t nlmsg_type, int index,
+                             unsigned char family) {
         struct ifaddrmsg *ifa;
         int r;
 
-        assert_return(message_type_is_addr(nlmsg_type), -EINVAL);
+        assert_return(rtnl_message_type_is_addr(nlmsg_type), -EINVAL);
         assert_return(index > 0, -EINVAL);
+        assert_return(family == AF_INET || family == AF_INET6, -EINVAL);
         assert_return(ret, -EINVAL);
 
-        r = message_new(ret, NLMSG_SPACE(sizeof(struct ifaddrmsg)));
+        r = message_new(rtnl, ret, NLMSG_SPACE(sizeof(struct ifaddrmsg)));
         if (r < 0)
                 return r;
 
         (*ret)->hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct ifaddrmsg));
         (*ret)->hdr->nlmsg_type = nlmsg_type;
+        if (nlmsg_type == RTM_GETADDR && family == AF_INET)
+                (*ret)->hdr->nlmsg_flags |= NLM_F_DUMP;
 
         ifa = NLMSG_DATA((*ret)->hdr);
 
-        ifa->ifa_family = family;
-        ifa->ifa_prefixlen = prefixlen;
-        ifa->ifa_flags = flags;
-        ifa->ifa_scope = scope;
         ifa->ifa_index = index;
+        ifa->ifa_family = family;
+        if (family == AF_INET)
+                ifa->ifa_prefixlen = 32;
+        else if (family == AF_INET6)
+                ifa->ifa_prefixlen = 128;
 
         UPDATE_RTA(*ret, IFA_RTA(ifa));
 
@@ -252,6 +264,7 @@ sd_rtnl_message *sd_rtnl_message_ref(sd_rtnl_message *m) {
 
 sd_rtnl_message *sd_rtnl_message_unref(sd_rtnl_message *m) {
         if (m && REFCNT_DEC(m->n_ref) <= 0) {
+                sd_rtnl_unref(m->rtnl);
                 free(m->hdr);
                 free(m);
         }
@@ -273,7 +286,7 @@ int sd_rtnl_message_link_get_ifindex(sd_rtnl_message *m, int *ifindex) {
 
         assert_return(m, -EINVAL);
         assert_return(m->hdr, -EINVAL);
-        assert_return(message_type_is_link(m->hdr->nlmsg_type), -EINVAL);
+        assert_return(rtnl_message_type_is_link(m->hdr->nlmsg_type), -EINVAL);
         assert_return(ifindex, -EINVAL);
 
         ifi = NLMSG_DATA(m->hdr);
@@ -288,7 +301,7 @@ int sd_rtnl_message_link_get_flags(sd_rtnl_message *m, unsigned *flags) {
 
         assert_return(m, -EINVAL);
         assert_return(m->hdr, -EINVAL);
-        assert_return(message_type_is_link(m->hdr->nlmsg_type), -EINVAL);
+        assert_return(rtnl_message_type_is_link(m->hdr->nlmsg_type), -EINVAL);
         assert_return(flags, -EINVAL);
 
         ifi = NLMSG_DATA(m->hdr);
@@ -305,11 +318,14 @@ static int add_rtattr(sd_rtnl_message *m, unsigned short type, const void *data,
         struct nlmsghdr *new_hdr;
         struct rtattr *rta;
         char *padding;
+        unsigned i;
 
         assert(m);
         assert(m->hdr);
+        assert(!m->sealed);
         assert(NLMSG_ALIGN(m->hdr->nlmsg_len) == m->hdr->nlmsg_len);
         assert(!data || data_length > 0);
+        assert(data || m->n_containers < RTNL_CONTAINER_DEPTH);
 
         /* get the size of the new rta attribute (with padding at the end) */
         rta_length = RTA_LENGTH(data_length);
@@ -326,16 +342,16 @@ static int add_rtattr(sd_rtnl_message *m, unsigned short type, const void *data,
         /* get pointer to the attribute we are about to add */
         rta = (struct rtattr *) ((uint8_t *) m->hdr + m->hdr->nlmsg_len);
 
-        /* if we are inside a container, extend it */
-        if (CURRENT_CONTAINER(m))
-                CURRENT_CONTAINER(m)->rta_len += message_length - m->hdr->nlmsg_len;
+        /* if we are inside containers, extend them */
+        for (i = 0; i < m->n_containers; i++)
+                GET_CONTAINER(m, i)->rta_len += message_length - m->hdr->nlmsg_len;
 
         /* fill in the attribute */
         rta->rta_type = type;
         rta->rta_len = rta_length;
         if (!data) {
                 /* this is the start of a new container */
-                m->container_offset = m->hdr->nlmsg_len;
+                m->container_offsets[m->n_containers ++] = m->hdr->nlmsg_len;
         } else {
                 /* we don't deal with the case where the user lies about the type
                  * and gives us too little data (so don't do that)
@@ -357,6 +373,7 @@ int sd_rtnl_message_append_string(sd_rtnl_message *m, unsigned short type, const
         int r;
 
         assert_return(m, -EINVAL);
+        assert_return(!m->sealed, -EPERM);
         assert_return(data, -EINVAL);
 
         r = sd_rtnl_message_get_type(m, &rtm_type);
@@ -369,8 +386,8 @@ int sd_rtnl_message_append_string(sd_rtnl_message *m, unsigned short type, const
                 case RTM_SETLINK:
                 case RTM_GETLINK:
                 case RTM_DELLINK:
-                        if (CURRENT_CONTAINER(m)) {
-                                if (CURRENT_CONTAINER(m)->rta_type != IFLA_LINKINFO ||
+                        if (m->n_containers == 1) {
+                                if (GET_CONTAINER(m, 0)->rta_type != IFLA_LINKINFO ||
                                     type != IFLA_INFO_KIND)
                                         return -ENOTSUP;
                         } else {
@@ -401,11 +418,86 @@ int sd_rtnl_message_append_string(sd_rtnl_message *m, unsigned short type, const
         return 0;
 }
 
+int sd_rtnl_message_append_u8(sd_rtnl_message *m, unsigned short type, uint8_t data) {
+        uint16_t rtm_type;
+        int r;
+
+        assert_return(m, -EINVAL);
+        assert_return(!m->sealed, -EPERM);
+
+        r = sd_rtnl_message_get_type(m, &rtm_type);
+        if (r < 0)
+                return r;
+
+        switch (rtm_type) {
+                case RTM_NEWLINK:
+                case RTM_SETLINK:
+                case RTM_GETLINK:
+                case RTM_DELLINK:
+                        switch (type) {
+                                case IFLA_CARRIER:
+                                case IFLA_OPERSTATE:
+                                case IFLA_LINKMODE:
+                                break;
+                        default:
+                                return -ENOTSUP;
+                        }
+
+                        break;
+                default:
+                        return -ENOTSUP;
+        }
+
+        r = add_rtattr(m, type, &data, sizeof(uint8_t));
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
+
+int sd_rtnl_message_append_u16(sd_rtnl_message *m, unsigned short type, uint16_t data) {
+        uint16_t rtm_type;
+        int r;
+
+        assert_return(m, -EINVAL);
+        assert_return(!m->sealed, -EPERM);
+
+        r = sd_rtnl_message_get_type(m, &rtm_type);
+        if (r < 0)
+                return r;
+
+        /* check that the type is correct */
+        switch (rtm_type) {
+                case RTM_NEWLINK:
+                case RTM_SETLINK:
+                case RTM_GETLINK:
+                case RTM_DELLINK:
+                        if (m->n_containers == 2 &&
+                            GET_CONTAINER(m, 0)->rta_type == IFLA_LINKINFO &&
+                            GET_CONTAINER(m, 1)->rta_type == IFLA_INFO_DATA &&
+                            type == IFLA_VLAN_ID)
+                                break;
+                        else
+                                return -ENOTSUP;
+
+                default:
+                        return -ENOTSUP;
+        }
+
+        r = add_rtattr(m, type, &data, sizeof(uint16_t));
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
 int sd_rtnl_message_append_u32(sd_rtnl_message *m, unsigned short type, uint32_t data) {
         uint16_t rtm_type;
         int r;
 
         assert_return(m, -EINVAL);
+        assert_return(!m->sealed, -EPERM);
 
         r = sd_rtnl_message_get_type(m, &rtm_type);
         if (r < 0)
@@ -421,6 +513,14 @@ int sd_rtnl_message_append_u32(sd_rtnl_message *m, unsigned short type, uint32_t
                                 case IFLA_MASTER:
                                 case IFLA_MTU:
                                 case IFLA_LINK:
+                                case IFLA_GROUP:
+                                case IFLA_TXQLEN:
+                                case IFLA_WEIGHT:
+                                case IFLA_NET_NS_FD:
+                                case IFLA_NET_NS_PID:
+                                case IFLA_PROMISCUITY:
+                                case IFLA_NUM_TX_QUEUES:
+                                case IFLA_NUM_RX_QUEUES:
                                         break;
                                 default:
                                         return -ENOTSUP;
@@ -434,6 +534,7 @@ int sd_rtnl_message_append_u32(sd_rtnl_message *m, unsigned short type, uint32_t
                                 case RTA_PRIORITY:
                                 case RTA_IIF:
                                 case RTA_OIF:
+                                case RTA_MARK:
                                         break;
                                 default:
                                         return -ENOTSUP;
@@ -457,6 +558,7 @@ int sd_rtnl_message_append_in_addr(sd_rtnl_message *m, unsigned short type, cons
         int r;
 
         assert_return(m, -EINVAL);
+        assert_return(!m->sealed, -EPERM);
         assert_return(data, -EINVAL);
 
         r = sd_rtnl_message_get_type(m, &rtm_type);
@@ -518,6 +620,7 @@ int sd_rtnl_message_append_in6_addr(sd_rtnl_message *m, unsigned short type, con
         int r;
 
         assert_return(m, -EINVAL);
+        assert_return(!m->sealed, -EPERM);
         assert_return(data, -EINVAL);
 
         r = sd_rtnl_message_get_type(m, &rtm_type);
@@ -576,6 +679,7 @@ int sd_rtnl_message_append_ether_addr(sd_rtnl_message *m, unsigned short type, c
         int r;
 
         assert_return(m, -EINVAL);
+        assert_return(!m->sealed, -EPERM);
         assert_return(data, -EINVAL);
 
         sd_rtnl_message_get_type(m, &rtm_type);
@@ -608,26 +712,31 @@ int sd_rtnl_message_open_container(sd_rtnl_message *m, unsigned short type) {
         uint16_t rtm_type;
 
         assert_return(m, -EINVAL);
-        assert_return(!CURRENT_CONTAINER(m), -EINVAL);
+        assert_return(!m->sealed, -EPERM);
 
         sd_rtnl_message_get_type(m, &rtm_type);
 
-        if (message_type_is_link(rtm_type)) {
-                if (type == IFLA_LINKINFO)
+        if (rtnl_message_type_is_link(rtm_type)) {
+
+                if ((type == IFLA_LINKINFO && m->n_containers == 0) ||
+                    (type == IFLA_INFO_DATA && m->n_containers == 1 &&
+                     GET_CONTAINER(m, 0)->rta_type == IFLA_LINKINFO))
                         return add_rtattr(m, type, NULL, 0);
-                else
-                        return -ENOTSUP;
-        } else
-                return -ENOTSUP;
+                else if (type == VETH_INFO_PEER && m->n_containers == 2 &&
+                         GET_CONTAINER(m, 1)->rta_type == IFLA_INFO_DATA &&
+                         GET_CONTAINER(m, 0)->rta_type == IFLA_LINKINFO)
+                        return add_rtattr(m, type, NULL, sizeof(struct ifinfomsg));
+        }
 
-        return 0;
+        return -ENOTSUP;
 }
 
 int sd_rtnl_message_close_container(sd_rtnl_message *m) {
         assert_return(m, -EINVAL);
-        assert_return(CURRENT_CONTAINER(m), -EINVAL);
+        assert_return(!m->sealed, -EPERM);
+        assert_return(m->n_containers > 0, -EINVAL);
 
-        m->container_offset = 0;
+        m->n_containers --;
 
         return 0;
 }
@@ -637,35 +746,58 @@ int sd_rtnl_message_read(sd_rtnl_message *m, unsigned short *type, void **data)
         uint16_t rtm_type;
         int r;
 
-        assert(m);
-        assert(m->next_rta_offset);
-        assert(type);
-        assert(data);
+        assert_return(m, -EINVAL);
+        assert_return(m->sealed, -EPERM);
+        assert_return(m->next_rta_offset, -EINVAL);
+        assert_return(type, -EINVAL);
+        assert_return(data, -EINVAL);
 
-        remaining_size = m->hdr->nlmsg_len - m->next_rta_offset;
+        /* only read until the end of the current container */
+        if (m->n_containers)
+                remaining_size = GET_CONTAINER(m, m->n_containers - 1)->rta_len -
+                                 (m->next_rta_offset -
+                                  m->container_offsets[m->n_containers - 1]);
+        else
+                remaining_size = m->hdr->nlmsg_len - m->next_rta_offset;
 
         if (!RTA_OK(NEXT_RTA(m), remaining_size))
                 return 0;
 
-        /* make sure we don't try to read a container
-         * TODO: add support for entering containers for reading */
+        /* if we read a container, enter it and return its type */
         r = sd_rtnl_message_get_type(m, &rtm_type);
         if (r < 0)
                 return r;
 
-        if (message_type_is_link(rtm_type) &&
-            NEXT_RTA(m)->rta_type == IFLA_LINKINFO)
-               return -EINVAL;
-
-        *data = RTA_DATA(NEXT_RTA(m));
         *type = NEXT_RTA(m)->rta_type;
 
-        UPDATE_RTA(m, RTA_NEXT(NEXT_RTA(m), remaining_size));
+        if (rtnl_message_type_is_link(rtm_type) &&
+            ((m->n_containers == 0 &&
+              NEXT_RTA(m)->rta_type == IFLA_LINKINFO) ||
+             (m->n_containers == 1 &&
+              GET_CONTAINER(m, 0)->rta_type == IFLA_LINKINFO &&
+              NEXT_RTA(m)->rta_type == IFLA_INFO_DATA))) {
+                *data = NULL;
+                PUSH_CONTAINER(m, NEXT_RTA(m));
+                UPDATE_RTA(m, RTA_DATA(NEXT_RTA(m)));
+        } else {
+                *data = RTA_DATA(NEXT_RTA(m));
+                UPDATE_RTA(m, RTA_NEXT(NEXT_RTA(m), remaining_size));
+        }
 
         return 1;
 }
 
-uint32_t message_get_serial(sd_rtnl_message *m) {
+int sd_rtnl_message_exit_container(sd_rtnl_message *m) {
+        assert_return(m, -EINVAL);
+        assert_return(m->sealed, -EINVAL);
+        assert_return(m->n_containers > 0, -EINVAL);
+
+        m->n_containers --;
+
+        return 0;
+}
+
+uint32_t rtnl_message_get_serial(sd_rtnl_message *m) {
         assert(m);
         assert(m->hdr);
 
@@ -686,17 +818,24 @@ int sd_rtnl_message_get_errno(sd_rtnl_message *m) {
         return err->error;
 }
 
-int message_seal(sd_rtnl *nl, sd_rtnl_message *m) {
-        assert(nl);
+int rtnl_message_seal(sd_rtnl *nl, sd_rtnl_message *m) {
+        int r;
+
         assert(m);
         assert(m->hdr);
 
         if (m->sealed)
                 return -EPERM;
 
-        m->hdr->nlmsg_seq = nl->serial++;
+        if (nl)
+                m->hdr->nlmsg_seq = nl->serial++;
+
         m->sealed = true;
 
+        r = sd_rtnl_message_rewind(m);
+        if (r < 0)
+                return r;
+
         return 0;
 }
 
@@ -765,10 +904,13 @@ int socket_read_message(sd_rtnl *nl, sd_rtnl_message **ret) {
         if (r < 0)
                 return r;
 
-        r = message_new(&m, need);
+        r = message_new(nl, &m, need);
         if (r < 0)
                 return r;
 
+        /* don't allow sealing/appending to received messages */
+        m->sealed = true;
+
         addr_len = sizeof(addr);
 
         k = recvfrom(nl->fd, m->hdr, need,
@@ -790,10 +932,6 @@ int socket_read_message(sd_rtnl *nl, sd_rtnl_message **ret) {
 
         if (k > 0)
                 switch (m->hdr->nlmsg_type) {
-                        struct ifinfomsg *ifi;
-                        struct ifaddrmsg *ifa;
-                        struct rtmsg *rtm;
-
                         /* check that the size matches the message type */
                         case NLMSG_ERROR:
                                 if (m->hdr->nlmsg_len < NLMSG_LENGTH(sizeof(struct nlmsgerr)))
@@ -806,6 +944,8 @@ int socket_read_message(sd_rtnl *nl, sd_rtnl_message **ret) {
                                 if (m->hdr->nlmsg_len < NLMSG_LENGTH(sizeof(struct ifinfomsg)))
                                         k = -EIO;
                                 else {
+                                        struct ifinfomsg *ifi;
+
                                         ifi = NLMSG_DATA(m->hdr);
                                         UPDATE_RTA(m, IFLA_RTA(ifi));
                                 }
@@ -816,6 +956,8 @@ int socket_read_message(sd_rtnl *nl, sd_rtnl_message **ret) {
                                 if (m->hdr->nlmsg_len < NLMSG_LENGTH(sizeof(struct ifaddrmsg)))
                                         k = -EIO;
                                 else {
+                                        struct ifaddrmsg *ifa;
+
                                         ifa = NLMSG_DATA(m->hdr);
                                         UPDATE_RTA(m, IFA_RTA(ifa));
                                 }
@@ -826,6 +968,8 @@ int socket_read_message(sd_rtnl *nl, sd_rtnl_message **ret) {
                                 if (m->hdr->nlmsg_len < NLMSG_LENGTH(sizeof(struct rtmsg)))
                                         k = -EIO;
                                 else {
+                                        struct rtmsg *rtm;
+
                                         rtm = NLMSG_DATA(m->hdr);
                                         UPDATE_RTA(m, RTM_RTA(rtm));
                                 }
@@ -854,6 +998,7 @@ int sd_rtnl_message_rewind(sd_rtnl_message *m) {
         struct rtmsg *rtm;
 
         assert_return(m, -EINVAL);
+        assert_return(m->sealed, -EPERM);
         assert_return(m->hdr, -EINVAL);
 
         switch(m->hdr->nlmsg_type) {
@@ -883,5 +1028,7 @@ int sd_rtnl_message_rewind(sd_rtnl_message *m) {
                         return -ENOTSUP;
         }
 
+        m->n_containers = 0;
+
         return 0;
 }