From 70060d84f268250fd0bead2928eba8739e3eb486 Mon Sep 17 00:00:00 2001 From: Gris Ge Date: Wed, 11 Dec 2024 22:22:59 +0800 Subject: [PATCH 1/2] vpn: Place gateway route to table defined in ipvx.route-table Previously, NM create direct route to gateway to main(254) route table regardless `ipvx.route-table` value. Fixed by setting `NMPlatformIP4Route.table_any` to `TRUE`. Resolves: https://issues.redhat.com/browse/RHEL-69901 Signed-off-by: Gris Ge (cherry picked from commit 6d06286f1db7421bef1c4dab5fada918c59daf87) (cherry picked from commit 29f23d3519dbb4dcffc9682fbdfb721cfc0b851c) (cherry picked from commit 0dc07c5ca4d32b5ea8e104cbad106da9bb5b096d) (cherry picked from commit 6a04a966c28dbe04e3bd608af06a66cf0af89d21) --- src/core/vpn/nm-vpn-connection.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/core/vpn/nm-vpn-connection.c b/src/core/vpn/nm-vpn-connection.c index 3dba9ff6c8..25a357f6d8 100644 --- a/src/core/vpn/nm-vpn-connection.c +++ b/src/core/vpn/nm-vpn-connection.c @@ -1242,6 +1242,7 @@ _parent_device_l3cd_add_gateway_route(NML3ConfigData *l3cd, .gateway = parent_gw.addr4, .rt_source = NM_IP_CONFIG_SOURCE_VPN, .metric_any = TRUE, + .table_any = TRUE, }; } else { route.r6 = (NMPlatformIP6Route){ @@ -1251,6 +1252,7 @@ _parent_device_l3cd_add_gateway_route(NML3ConfigData *l3cd, .gateway = parent_gw.addr6, .rt_source = NM_IP_CONFIG_SOURCE_VPN, .metric_any = TRUE, + .table_any = TRUE, }; } nm_l3_config_data_add_route(l3cd, addr_family, NULL, &route.rx); @@ -1267,6 +1269,7 @@ _parent_device_l3cd_add_gateway_route(NML3ConfigData *l3cd, .plen = 32, .rt_source = NM_IP_CONFIG_SOURCE_VPN, .metric_any = TRUE, + .table_any = TRUE, }; } else { route.r6 = (NMPlatformIP6Route){ @@ -1274,6 +1277,7 @@ _parent_device_l3cd_add_gateway_route(NML3ConfigData *l3cd, .plen = 128, .rt_source = NM_IP_CONFIG_SOURCE_VPN, .metric_any = TRUE, + .table_any = TRUE, }; } nm_l3_config_data_add_route(l3cd, addr_family, NULL, &route.rx); From f5e8217f77863742ac17b2ad30134a14125acd40 Mon Sep 17 00:00:00 2001 From: Wen Liang Date: Fri, 20 Dec 2024 10:10:25 -0500 Subject: [PATCH 2/2] vpn: fix routing rules support in vpn conenctions This commit introduces the ability to manage routing rules specifically for VPN connections. These rules allow finer control over traffic routing by enabling the specification of policy-based routing for traffic over the VPN. - Updated the connection backend to apply rules during VPN activation. - Ensured proper cleanup of routing rules upon VPN deactivation. This enhancement improves VPN usability in scenarios requiring advanced routing configurations, such as split tunneling and traffic prioritization. Resolves: https://issues.redhat.com/browse/RHEL-70160 https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2092 https://gitlab.freedesktop.org/NetworkManager/NetworkManager-ci/-/merge_requests/1842 (cherry picked from commit 308e34a501482d01c1cc6c87c38791ad9f34dc1f) (cherry picked from commit a24b347e93e37b04aa0f5698efcb462c02517c09) (cherry picked from commit b5c46f8a8d644e1c5a6dc07e06d5dab3338e9a91) (cherry picked from commit 7824d5e5ae5db78abdc6fa24453d939198a5d1da) --- src/core/devices/nm-device.c | 62 +++++++++++++++++++------------- src/core/devices/nm-device.h | 6 ++++ src/core/vpn/nm-vpn-connection.c | 7 +++- 3 files changed, 50 insertions(+), 25 deletions(-) diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c index 38b2cf9fc8..b944fe20b4 100644 --- a/src/core/devices/nm-device.c +++ b/src/core/devices/nm-device.c @@ -9933,31 +9933,34 @@ lldp_setup(NMDevice *self, NMTernary enabled) * as externally added ones. Don't restart NetworkManager if * you care about that. */ -static void -_routing_rules_sync(NMDevice *self, NMTernary set_mode) +void +nm_routing_rules_sync(NMConnection *applied_connection, + NMTernary set_mode, + GPtrArray *(*get_extra_rules)(NMDevice *self), + NMDevice *self, + NMNetns *netns) { - NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE(self); - NMPGlobalTracker *global_tracker = nm_netns_get_global_tracker(nm_device_get_netns(self)); - NMDeviceClass *klass = NM_DEVICE_GET_CLASS(self); + NMPGlobalTracker *global_tracker = nm_netns_get_global_tracker(netns); gboolean untrack_only_dirty = FALSE; gboolean keep_deleted_rules; gpointer user_tag_1; gpointer user_tag_2; - /* take two arbitrary user-tag pointers that belong to @self. */ - user_tag_1 = &priv->v4_route_table; - user_tag_2 = &priv->v6_route_table; + if (self) { + user_tag_1 = ((guint32 *) self) + 1; + user_tag_2 = ((guint32 *) self) + 2; + } else { + user_tag_1 = ((guint32 *) applied_connection) + 1; + user_tag_2 = ((guint32 *) applied_connection) + 2; + } if (set_mode == NM_TERNARY_TRUE) { - NMConnection *applied_connection; NMSettingIPConfig *s_ip; guint i, num; int is_ipv4; untrack_only_dirty = TRUE; - applied_connection = nm_device_get_applied_connection(self); - for (is_ipv4 = 0; applied_connection && is_ipv4 < 2; is_ipv4++) { int addr_family = is_ipv4 ? AF_INET : AF_INET6; @@ -9996,10 +9999,10 @@ _routing_rules_sync(NMDevice *self, NMTernary set_mode) } } - if (klass->get_extra_rules) { + if (get_extra_rules) { gs_unref_ptrarray GPtrArray *extra_rules = NULL; - extra_rules = klass->get_extra_rules(self); + extra_rules = get_extra_rules(self); if (extra_rules) { for (i = 0; i < extra_rules->len; i++) { nmp_global_tracker_track_rule( @@ -10014,7 +10017,7 @@ _routing_rules_sync(NMDevice *self, NMTernary set_mode) } nmp_global_tracker_untrack_all(global_tracker, user_tag_1, !untrack_only_dirty, TRUE); - if (klass->get_extra_rules) + if (get_extra_rules) nmp_global_tracker_untrack_all(global_tracker, user_tag_2, !untrack_only_dirty, TRUE); keep_deleted_rules = FALSE; @@ -10074,8 +10077,8 @@ tc_commit(NMDevice *self) static void activate_stage2_device_config(NMDevice *self) { - NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE(self); - NMDeviceClass *klass; + NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE(self); + NMDeviceClass *klass = NM_DEVICE_GET_CLASS(self); NMActStageReturn ret; NMSettingWired *s_wired; gboolean no_firmware = FALSE; @@ -10100,7 +10103,11 @@ activate_stage2_device_config(NMDevice *self) priv->tc_committed = TRUE; } - _routing_rules_sync(self, NM_TERNARY_TRUE); + nm_routing_rules_sync(nm_device_get_applied_connection(self), + NM_TERNARY_TRUE, + klass->get_extra_rules, + self, + nm_device_get_netns(self)); if (!nm_device_sys_iface_state_is_external_or_assume(self)) { if (!nm_device_bring_up_full(self, FALSE, TRUE, &no_firmware)) { @@ -10112,7 +10119,6 @@ activate_stage2_device_config(NMDevice *self) } } - klass = NM_DEVICE_GET_CLASS(self); if (klass->act_stage2_config_also_for_external_or_assume || !nm_device_sys_iface_state_is_external_or_assume(self)) { NMDeviceStateReason failure_reason = NM_DEVICE_STATE_REASON_NONE; @@ -13438,7 +13444,11 @@ check_and_reapply_connection(NMDevice *self, nm_device_activate_schedule_stage3_ip_config(self, FALSE); - _routing_rules_sync(self, NM_TERNARY_TRUE); + nm_routing_rules_sync(nm_device_get_applied_connection(self), + NM_TERNARY_TRUE, + klass->get_extra_rules, + self, + nm_device_get_netns(self)); reactivate_proxy_config(self); @@ -15947,6 +15957,7 @@ static void nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanup_type) { NMDevicePrivate *priv; + NMDeviceClass *klass = NM_DEVICE_GET_CLASS(self); int ifindex; g_return_if_fail(NM_IS_DEVICE(self)); @@ -15971,8 +15982,8 @@ nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanu } /* Call device type-specific deactivation */ - if (NM_DEVICE_GET_CLASS(self)->deactivate) - NM_DEVICE_GET_CLASS(self)->deactivate(self); + if (klass->deactivate) + klass->deactivate(self); ifindex = nm_device_get_ip_ifindex(self); @@ -15994,8 +16005,11 @@ nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanu priv->tc_committed = FALSE; - _routing_rules_sync(self, - cleanup_type == CLEANUP_TYPE_KEEP ? NM_TERNARY_DEFAULT : NM_TERNARY_FALSE); + nm_routing_rules_sync(nm_device_get_applied_connection(self), + cleanup_type == CLEANUP_TYPE_KEEP ? NM_TERNARY_DEFAULT : NM_TERNARY_FALSE, + klass->get_extra_rules, + self, + nm_device_get_netns(self)); if (ifindex > 0) nm_platform_ip4_dev_route_blacklist_set(nm_device_get_platform(self), ifindex, NULL); @@ -16024,7 +16038,7 @@ nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanu /* for other device states (UNAVAILABLE, DISCONNECTED), allow the * device to overwrite the reset behavior, so that Wi-Fi can set * a randomized MAC address used during scanning. */ - NM_DEVICE_GET_CLASS(self)->deactivate_reset_hw_addr(self); + klass->deactivate_reset_hw_addr(self); } } diff --git a/src/core/devices/nm-device.h b/src/core/devices/nm-device.h index 198ea14318..a21be5ad33 100644 --- a/src/core/devices/nm-device.h +++ b/src/core/devices/nm-device.h @@ -848,4 +848,10 @@ void nm_device_clear_dns_lookup_data(NMDevice *self, const char *reason); gboolean nm_device_get_allow_autoconnect_on_external(NMDevice *self); +void nm_routing_rules_sync(NMConnection *applied_connection, + NMTernary set_mode, + GPtrArray *(*get_extra_rules)(NMDevice *self), + NMDevice *self, + NMNetns *netns); + #endif /* __NETWORKMANAGER_DEVICE_H__ */ diff --git a/src/core/vpn/nm-vpn-connection.c b/src/core/vpn/nm-vpn-connection.c index 25a357f6d8..110a2d98b3 100644 --- a/src/core/vpn/nm-vpn-connection.c +++ b/src/core/vpn/nm-vpn-connection.c @@ -905,7 +905,8 @@ fw_call_cleanup(NMVpnConnection *self) static void vpn_cleanup(NMVpnConnection *self, NMDevice *parent_dev) { - const char *iface; + NMVpnConnectionPrivate *priv = NM_VPN_CONNECTION_GET_PRIVATE(self); + const char *iface; /* Remove zone from firewall */ iface = nm_vpn_connection_get_ip_iface(self, FALSE); @@ -917,6 +918,8 @@ vpn_cleanup(NMVpnConnection *self, NMDevice *parent_dev) fw_call_cleanup(self); _l3cfg_l3cd_clear_all(self); + + nm_routing_rules_sync(_get_applied_connection(self), NM_TERNARY_FALSE, NULL, NULL, priv->netns); } static void @@ -2230,6 +2233,8 @@ _dbus_signal_ip_config_cb(NMVpnConnection *self, int addr_family, GVariant *dict _l3cfg_l3cd_set(self, L3CD_TYPE_IP_X(IS_IPv4), l3cd); + nm_routing_rules_sync(_get_applied_connection(self), NM_TERNARY_TRUE, NULL, NULL, priv->netns); + _check_complete(self, TRUE); }