From b92a07713c17eb55fb3f0cfa4c757e379c432e17 Mon Sep 17 00:00:00 2001 From: Gris Ge Date: Wed, 11 Dec 2024 22:22:59 +0800 Subject: [PATCH 1/2] vpn: Place gateway route to table defined in ipvx.route-table Previously, NM create direct route to gateway to main(254) route table regardless `ipvx.route-table` value. Fixed by setting `NMPlatformIP4Route.table_any` to `TRUE`. Resolves: https://issues.redhat.com/browse/RHEL-69901 Signed-off-by: Gris Ge (cherry picked from commit 6d06286f1db7421bef1c4dab5fada918c59daf87) (cherry picked from commit 29f23d3519dbb4dcffc9682fbdfb721cfc0b851c) (cherry picked from commit 0dc07c5ca4d32b5ea8e104cbad106da9bb5b096d) (cherry picked from commit 6a04a966c28dbe04e3bd608af06a66cf0af89d21) (cherry picked from commit 70060d84f268250fd0bead2928eba8739e3eb486) --- src/core/vpn/nm-vpn-connection.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/core/vpn/nm-vpn-connection.c b/src/core/vpn/nm-vpn-connection.c index d7102a12ef..eb09f9f33e 100644 --- a/src/core/vpn/nm-vpn-connection.c +++ b/src/core/vpn/nm-vpn-connection.c @@ -1241,6 +1241,7 @@ _parent_device_l3cd_add_gateway_route(NML3ConfigData *l3cd, .gateway = parent_gw.addr4, .rt_source = NM_IP_CONFIG_SOURCE_VPN, .metric_any = TRUE, + .table_any = TRUE, }; } else { route.r6 = (NMPlatformIP6Route){ @@ -1250,6 +1251,7 @@ _parent_device_l3cd_add_gateway_route(NML3ConfigData *l3cd, .gateway = parent_gw.addr6, .rt_source = NM_IP_CONFIG_SOURCE_VPN, .metric_any = TRUE, + .table_any = TRUE, }; } nm_l3_config_data_add_route(l3cd, addr_family, NULL, &route.rx); @@ -1266,6 +1268,7 @@ _parent_device_l3cd_add_gateway_route(NML3ConfigData *l3cd, .plen = 32, .rt_source = NM_IP_CONFIG_SOURCE_VPN, .metric_any = TRUE, + .table_any = TRUE, }; } else { route.r6 = (NMPlatformIP6Route){ @@ -1273,6 +1276,7 @@ _parent_device_l3cd_add_gateway_route(NML3ConfigData *l3cd, .plen = 128, .rt_source = NM_IP_CONFIG_SOURCE_VPN, .metric_any = TRUE, + .table_any = TRUE, }; } nm_l3_config_data_add_route(l3cd, addr_family, NULL, &route.rx); From dcbe04ef5f8bf947d1da4e55a1b9b0ca498d852d Mon Sep 17 00:00:00 2001 From: Wen Liang Date: Fri, 20 Dec 2024 10:10:25 -0500 Subject: [PATCH 2/2] vpn: fix routing rules support in vpn conenctions This commit introduces the ability to manage routing rules specifically for VPN connections. These rules allow finer control over traffic routing by enabling the specification of policy-based routing for traffic over the VPN. - Updated the connection backend to apply rules during VPN activation. - Ensured proper cleanup of routing rules upon VPN deactivation. This enhancement improves VPN usability in scenarios requiring advanced routing configurations, such as split tunneling and traffic prioritization. Resolves: https://issues.redhat.com/browse/RHEL-70160 https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2092 https://gitlab.freedesktop.org/NetworkManager/NetworkManager-ci/-/merge_requests/1842 (cherry picked from commit 308e34a501482d01c1cc6c87c38791ad9f34dc1f) (cherry picked from commit a24b347e93e37b04aa0f5698efcb462c02517c09) (cherry picked from commit b5c46f8a8d644e1c5a6dc07e06d5dab3338e9a91) (cherry picked from commit 7824d5e5ae5db78abdc6fa24453d939198a5d1da) (cherry picked from commit f5e8217f77863742ac17b2ad30134a14125acd40) --- src/core/devices/nm-device.c | 62 +++++++++++++++++++------------- src/core/devices/nm-device.h | 6 ++++ src/core/vpn/nm-vpn-connection.c | 7 +++- 3 files changed, 50 insertions(+), 25 deletions(-) diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c index 1a8c5da33e..8d233e819b 100644 --- a/src/core/devices/nm-device.c +++ b/src/core/devices/nm-device.c @@ -9635,31 +9635,34 @@ lldp_setup(NMDevice *self, NMTernary enabled) * as externally added ones. Don't restart NetworkManager if * you care about that. */ -static void -_routing_rules_sync(NMDevice *self, NMTernary set_mode) +void +nm_routing_rules_sync(NMConnection *applied_connection, + NMTernary set_mode, + GPtrArray *(*get_extra_rules)(NMDevice *self), + NMDevice *self, + NMNetns *netns) { - NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE(self); - NMPGlobalTracker *global_tracker = nm_netns_get_global_tracker(nm_device_get_netns(self)); - NMDeviceClass *klass = NM_DEVICE_GET_CLASS(self); + NMPGlobalTracker *global_tracker = nm_netns_get_global_tracker(netns); gboolean untrack_only_dirty = FALSE; gboolean keep_deleted_rules; gpointer user_tag_1; gpointer user_tag_2; - /* take two arbitrary user-tag pointers that belong to @self. */ - user_tag_1 = &priv->v4_route_table; - user_tag_2 = &priv->v6_route_table; + if (self) { + user_tag_1 = ((guint32 *) self) + 1; + user_tag_2 = ((guint32 *) self) + 2; + } else { + user_tag_1 = ((guint32 *) applied_connection) + 1; + user_tag_2 = ((guint32 *) applied_connection) + 2; + } if (set_mode == NM_TERNARY_TRUE) { - NMConnection *applied_connection; NMSettingIPConfig *s_ip; guint i, num; int is_ipv4; untrack_only_dirty = TRUE; - applied_connection = nm_device_get_applied_connection(self); - for (is_ipv4 = 0; applied_connection && is_ipv4 < 2; is_ipv4++) { int addr_family = is_ipv4 ? AF_INET : AF_INET6; @@ -9698,10 +9701,10 @@ _routing_rules_sync(NMDevice *self, NMTernary set_mode) } } - if (klass->get_extra_rules) { + if (get_extra_rules) { gs_unref_ptrarray GPtrArray *extra_rules = NULL; - extra_rules = klass->get_extra_rules(self); + extra_rules = get_extra_rules(self); if (extra_rules) { for (i = 0; i < extra_rules->len; i++) { nmp_global_tracker_track_rule( @@ -9716,7 +9719,7 @@ _routing_rules_sync(NMDevice *self, NMTernary set_mode) } nmp_global_tracker_untrack_all(global_tracker, user_tag_1, !untrack_only_dirty, TRUE); - if (klass->get_extra_rules) + if (get_extra_rules) nmp_global_tracker_untrack_all(global_tracker, user_tag_2, !untrack_only_dirty, TRUE); keep_deleted_rules = FALSE; @@ -9776,8 +9779,8 @@ tc_commit(NMDevice *self) static void activate_stage2_device_config(NMDevice *self) { - NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE(self); - NMDeviceClass *klass; + NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE(self); + NMDeviceClass *klass = NM_DEVICE_GET_CLASS(self); NMActStageReturn ret; NMSettingWired *s_wired; gboolean no_firmware = FALSE; @@ -9800,7 +9803,11 @@ activate_stage2_device_config(NMDevice *self) priv->tc_committed = TRUE; } - _routing_rules_sync(self, NM_TERNARY_TRUE); + nm_routing_rules_sync(nm_device_get_applied_connection(self), + NM_TERNARY_TRUE, + klass->get_extra_rules, + self, + nm_device_get_netns(self)); if (!nm_device_sys_iface_state_is_external_or_assume(self)) { if (!nm_device_bring_up_full(self, FALSE, TRUE, &no_firmware)) { @@ -9812,7 +9819,6 @@ activate_stage2_device_config(NMDevice *self) } } - klass = NM_DEVICE_GET_CLASS(self); if (klass->act_stage2_config_also_for_external_or_assume || !nm_device_sys_iface_state_is_external_or_assume(self)) { NMDeviceStateReason failure_reason = NM_DEVICE_STATE_REASON_NONE; @@ -13095,7 +13101,11 @@ check_and_reapply_connection(NMDevice *self, nm_device_activate_schedule_stage3_ip_config(self, FALSE); - _routing_rules_sync(self, NM_TERNARY_TRUE); + nm_routing_rules_sync(nm_device_get_applied_connection(self), + NM_TERNARY_TRUE, + klass->get_extra_rules, + self, + nm_device_get_netns(self)); reactivate_proxy_config(self); @@ -15567,6 +15577,7 @@ static void nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanup_type) { NMDevicePrivate *priv; + NMDeviceClass *klass = NM_DEVICE_GET_CLASS(self); int ifindex; g_return_if_fail(NM_IS_DEVICE(self)); @@ -15591,8 +15602,8 @@ nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanu } /* Call device type-specific deactivation */ - if (NM_DEVICE_GET_CLASS(self)->deactivate) - NM_DEVICE_GET_CLASS(self)->deactivate(self); + if (klass->deactivate) + klass->deactivate(self); ifindex = nm_device_get_ip_ifindex(self); @@ -15614,8 +15625,11 @@ nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanu priv->tc_committed = FALSE; - _routing_rules_sync(self, - cleanup_type == CLEANUP_TYPE_KEEP ? NM_TERNARY_DEFAULT : NM_TERNARY_FALSE); + nm_routing_rules_sync(nm_device_get_applied_connection(self), + cleanup_type == CLEANUP_TYPE_KEEP ? NM_TERNARY_DEFAULT : NM_TERNARY_FALSE, + klass->get_extra_rules, + self, + nm_device_get_netns(self)); if (ifindex > 0) nm_platform_ip4_dev_route_blacklist_set(nm_device_get_platform(self), ifindex, NULL); @@ -15644,7 +15658,7 @@ nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanu /* for other device states (UNAVAILABLE, DISCONNECTED), allow the * device to overwrite the reset behavior, so that Wi-Fi can set * a randomized MAC address used during scanning. */ - NM_DEVICE_GET_CLASS(self)->deactivate_reset_hw_addr(self); + klass->deactivate_reset_hw_addr(self); } } diff --git a/src/core/devices/nm-device.h b/src/core/devices/nm-device.h index a37f008c34..18322ca5a1 100644 --- a/src/core/devices/nm-device.h +++ b/src/core/devices/nm-device.h @@ -827,4 +827,10 @@ void nm_device_clear_dns_lookup_data(NMDevice *self, const char *reason); gboolean nm_device_get_allow_autoconnect_on_external(NMDevice *self); +void nm_routing_rules_sync(NMConnection *applied_connection, + NMTernary set_mode, + GPtrArray *(*get_extra_rules)(NMDevice *self), + NMDevice *self, + NMNetns *netns); + #endif /* __NETWORKMANAGER_DEVICE_H__ */ diff --git a/src/core/vpn/nm-vpn-connection.c b/src/core/vpn/nm-vpn-connection.c index eb09f9f33e..24889ef3a0 100644 --- a/src/core/vpn/nm-vpn-connection.c +++ b/src/core/vpn/nm-vpn-connection.c @@ -905,7 +905,8 @@ fw_call_cleanup(NMVpnConnection *self) static void vpn_cleanup(NMVpnConnection *self, NMDevice *parent_dev) { - const char *iface; + NMVpnConnectionPrivate *priv = NM_VPN_CONNECTION_GET_PRIVATE(self); + const char *iface; /* Remove zone from firewall */ iface = nm_vpn_connection_get_ip_iface(self, FALSE); @@ -917,6 +918,8 @@ vpn_cleanup(NMVpnConnection *self, NMDevice *parent_dev) fw_call_cleanup(self); _l3cfg_l3cd_clear_all(self); + + nm_routing_rules_sync(_get_applied_connection(self), NM_TERNARY_FALSE, NULL, NULL, priv->netns); } static void @@ -2229,6 +2232,8 @@ _dbus_signal_ip_config_cb(NMVpnConnection *self, int addr_family, GVariant *dict _l3cfg_l3cd_set(self, L3CD_TYPE_IP_X(IS_IPv4), l3cd); + nm_routing_rules_sync(_get_applied_connection(self), NM_TERNARY_TRUE, NULL, NULL, priv->netns); + _check_complete(self, TRUE); }