From 8cba3e046eb8e3db9ab0bd55bbadc6cb8043096d Mon Sep 17 00:00:00 2001 From: Beniamino Galvani Date: Thu, 21 Jan 2016 16:39:55 +0100 Subject: [PATCH 1/2] core: list iptables sharing rules in the right order The rules were added to the list using g_slist_append() and then applied one at time using "iptables --insert" which puts them at the beginning of the chain, reversing the initial order. Instead, list them in the desired order and use g_slist_prepend() to achieve the same result. This has no functional changes. --- src/devices/nm-device.c | 18 +++++++++--------- src/nm-activation-request.c | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c index 2b4dc1eda5..e843b9b7f4 100644 --- a/src/devices/nm-device.c +++ b/src/devices/nm-device.c @@ -6636,16 +6636,16 @@ start_sharing (NMDevice *self, NMIP4Config *config) req = nm_device_get_act_request (self); g_assert (req); - add_share_rule (req, "filter", "INPUT --in-interface %s --protocol tcp --destination-port 53 --jump ACCEPT", ip_iface); - add_share_rule (req, "filter", "INPUT --in-interface %s --protocol udp --destination-port 53 --jump ACCEPT", ip_iface); - add_share_rule (req, "filter", "INPUT --in-interface %s --protocol tcp --destination-port 67 --jump ACCEPT", ip_iface); - add_share_rule (req, "filter", "INPUT --in-interface %s --protocol udp --destination-port 67 --jump ACCEPT", ip_iface); - add_share_rule (req, "filter", "FORWARD --in-interface %s --jump REJECT", ip_iface); - add_share_rule (req, "filter", "FORWARD --out-interface %s --jump REJECT", ip_iface); - add_share_rule (req, "filter", "FORWARD --in-interface %s --out-interface %s --jump ACCEPT", ip_iface, ip_iface); - add_share_rule (req, "filter", "FORWARD --source %s/%s --in-interface %s --jump ACCEPT", str_addr, str_mask, ip_iface); - add_share_rule (req, "filter", "FORWARD --destination %s/%s --out-interface %s --match state --state ESTABLISHED,RELATED --jump ACCEPT", str_addr, str_mask, ip_iface); add_share_rule (req, "nat", "POSTROUTING --source %s/%s ! --destination %s/%s --jump MASQUERADE", str_addr, str_mask, str_addr, str_mask); + add_share_rule (req, "filter", "FORWARD --destination %s/%s --out-interface %s --match state --state ESTABLISHED,RELATED --jump ACCEPT", str_addr, str_mask, ip_iface); + add_share_rule (req, "filter", "FORWARD --source %s/%s --in-interface %s --jump ACCEPT", str_addr, str_mask, ip_iface); + add_share_rule (req, "filter", "FORWARD --in-interface %s --out-interface %s --jump ACCEPT", ip_iface, ip_iface); + add_share_rule (req, "filter", "FORWARD --out-interface %s --jump REJECT", ip_iface); + add_share_rule (req, "filter", "FORWARD --in-interface %s --jump REJECT", ip_iface); + add_share_rule (req, "filter", "INPUT --in-interface %s --protocol udp --destination-port 67 --jump ACCEPT", ip_iface); + add_share_rule (req, "filter", "INPUT --in-interface %s --protocol tcp --destination-port 67 --jump ACCEPT", ip_iface); + add_share_rule (req, "filter", "INPUT --in-interface %s --protocol udp --destination-port 53 --jump ACCEPT", ip_iface); + add_share_rule (req, "filter", "INPUT --in-interface %s --protocol tcp --destination-port 53 --jump ACCEPT", ip_iface); nm_act_request_set_shared (req, TRUE); diff --git a/src/nm-activation-request.c b/src/nm-activation-request.c index 30e98fcacb..04a39dba8b 100644 --- a/src/nm-activation-request.c +++ b/src/nm-activation-request.c @@ -346,7 +346,7 @@ nm_act_request_add_share_rule (NMActRequest *req, rule = g_malloc0 (sizeof (ShareRule)); rule->table = g_strdup (table); rule->rule = g_strdup (table_rule); - priv->share_rules = g_slist_append (priv->share_rules, rule); + priv->share_rules = g_slist_prepend (priv->share_rules, rule); } /********************************************************************/ From e3a6ba6756620b5ed64459141567dd7a760e2c30 Mon Sep 17 00:00:00 2001 From: Beniamino Galvani Date: Fri, 22 Jan 2016 15:19:06 +0100 Subject: [PATCH 2/2] manager: cleanup active connections upon exit When connection sharing is enabled, the removal of iptables rules is delegated to the NMActRequest destructor; but for this to work it is required that the object is properly dereferenced upon NM termination. Clean up the active connections which are in DEACTIVATED state when quitting, so that they are unexported and destroyed. https://bugzilla.gnome.org/show_bug.cgi?id=692673 --- src/nm-manager.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/nm-manager.c b/src/nm-manager.c index c2b4e531ab..f647c8f9e4 100644 --- a/src/nm-manager.c +++ b/src/nm-manager.c @@ -4418,6 +4418,8 @@ nm_manager_stop (NMManager *self) /* Remove all devices */ while (priv->devices) remove_device (self, NM_DEVICE (priv->devices->data), TRUE, TRUE); + + _active_connection_cleanup (self); } static gboolean