Commit graph

19371 commits

Author SHA1 Message Date
Thomas Haller
0970ea754a platform/tests: fix generating IPv6 link local address in fake-platform
(cherry picked from commit 07a34f2404)
(cherry picked from commit 4ca064043a)
2018-11-30 11:19:15 +01:00
Thomas Haller
214371e507 dnsmasq/shared: fix setting DNS nameserver and search for shared dnsmasq
Fixes: c8fa7b6f57

(cherry picked from commit 803514df27)
(cherry picked from commit 047747f9e3)
(cherry picked from commit 8708da118b)
2018-11-29 14:37:06 +01:00
Thomas Haller
8912c93664 platform/tests: fix assertion for unit test for address lifetime
Sometimes the test fail:

    $ make -j 10 src/platform/tests/test-address-linux
    $ while true; do
          NMTST_DEBUG=d ./tools/run-nm-test.sh src/platform/tests/test-address-linux 2>&1 > log.txt || break;
      done

fails with:

    ERROR: src/platform/tests/test-address-linux - Bail out! test:ERROR:src/platform/tests/test-common.c:790:nmtstp_ip_address_assert_lifetime: assertion failed (adr <= lft): (1001 <= 1000)

That is, because of a wrong check. Fix it.

(cherry picked from commit e180464bcc)
(cherry picked from commit 66cbca1f21)
(cherry picked from commit 7820d71ef0)
2018-11-28 16:18:29 +01:00
Patrick Talbert
2c10459b66 clients: Fix typo in _dump_team_link_watcher output
This makes the output of a 'con show' for a team device look suspect.

Signed-off-by: Patrick Talbert <ptalbert@redhat.com>

Fixes: 4657390d45

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/merge_requests/53
(cherry picked from commit 25a0739658)
(cherry picked from commit e28bfa41a0)
(cherry picked from commit 3444c1145d)
2018-11-23 17:42:28 +01:00
Beniamino Galvani
b59d155b4e libnm-core: fix documentation for connection.mdns
After an update of the connection.mdns property, a reactivation is
needed to apply the new value.

Also, the ifcfg-rh variable name was wrong.

Fixes: 2e2ff6f27a
(cherry picked from commit 8e6ad2853c)
(cherry picked from commit b5468828f4)
2018-11-22 11:53:08 +01:00
Beniamino Galvani
b97d38e579 lldp: fix parsing of vlan-name attribute
We used to read 3 bytes after the TLV, fix this.

Also, check that string length is at most 32 bytes as specified in
figure E.3 of IEEE 802.1AB-2009.

Fixes: 18133ea142

https://bugzilla.redhat.com/show_bug.cgi?id=1652210
(cherry picked from commit e909778710)
(cherry picked from commit 05c27c3c50)
(cherry picked from commit 6d4ad477b8)
2018-11-22 09:56:33 +01:00
Lubomir Rintel
ab42b9659d ndisc: mark a keep-alive variable unused
Fixed build with clang:

  src/ndisc/nm-lndp-ndisc.c:494:27: error: unused variable 'ndisc_keep_alive' [-Werror,-Wunused-variable]
        gs_unref_object NMNDisc *ndisc_keep_alive = g_object_ref (ndisc);
                                 ^
Fixes: 9aa628cedb

(cherry picked from commit 7c7e4cf134)
(cherry picked from commit 506f781488)
(cherry picked from commit 77234c352d)
2018-11-22 09:44:58 +01:00
Beniamino Galvani
d017022dfc device: clear the dhcp grace-period source id
Fixes: 17009ed91d
(cherry picked from commit db1867bafd)
(cherry picked from commit 5ccd7f7fd7)
2018-11-22 09:44:58 +01:00
Beniamino Galvani
21fd49f795 ifcfg-rh: fix parse of tc qdiscs and filters
Fixes: 902bbfdb18
(cherry picked from commit 805cbe7439)
2018-11-22 09:44:58 +01:00
Beniamino Galvani
4e0804b7ec release: bump version to 1.10.15 (development) 2018-11-20 11:04:30 +01:00
Beniamino Galvani
19339501a7 release: bump version to 1.10.14 2018-11-20 10:53:20 +01:00
Beniamino Galvani
530022b0e0 release: update NEWS 2018-11-20 10:50:50 +01:00
Benjamin Berg
fe5949dcff systemd: fix crash by unrefing event sources before re-adding them
In certain cases the timeouts may not have been unref'ed before they
need to be re-added. Add the appropriate unref calls to ensure we don't
register the timeout multiple times.

This fixes possible cases where timeouts are triggered multiple times
and even on destroyed DHCPv6 clients.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/issues/73

(cherry picked from commit e179202e47)
(cherry picked from commit bbef6cf44a)
(cherry picked from commit d535f95b6b)
2018-11-15 14:58:40 +01:00
Corentin Noël
b9c70ec0c5 libnm: fix GObject Introspection annotations for functions returning a GPtrArray
The GPtrArray owns the element so it is a (transfer full).

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/merge_requests/46
(cherry picked from commit 201c153e25)
(cherry picked from commit 7d5cce2e10)
(cherry picked from commit 000c805921)
2018-11-12 13:08:09 +01:00
Thomas Haller
00bbf47235 systemd: merge branch 'CVE-2018-15688' into nm-1-10 2018-10-29 20:24:34 +01:00
Lennart Poettering
c3221cb0c5 dhcp6: make sure we have enough space for the DHCP6 option header
Fixes a vulnerability originally discovered by Felix Wilhelm from
Google.

CVE-2018-15688
LP: #1795921
https://bugzilla.redhat.com/show_bug.cgi?id=1639067

(cherry picked from commit 4dac5eaba4e419b29c97da38a8b1f82336c2c892)
(cherry picked from commit 01ca2053bb)
(cherry picked from commit fc230dca13)
(cherry picked from commit cc1e5a7f57)
2018-10-29 18:59:14 +01:00
Li Song
1cfefbb99f sd-dhcp: remove unreachable route after rebinding return NAK
(cherry picked from commit cc3981b1272b9ce37e7d734a7b2f42e84acac535)
(cherry picked from commit 915c2f675a)
(cherry picked from commit cb77290a69)
(cherry picked from commit f211b140a5)
2018-10-29 18:58:45 +01:00
Yu Watanabe
4ca0e57c46 sd-dhcp6: make dhcp6_option_parse_domainname() not store empty domain
This improves performance of fuzzer.
C.f. oss-fuzz#11019.

(cherry picked from commit 3c72b6ed4252e7ff5f7704bfe44557ec197b47fa)
(cherry picked from commit 50403cccee)
(cherry picked from commit f11f5abb1a)
(cherry picked from commit c836279fca)
2018-10-29 18:57:41 +01:00
Yu Watanabe
4439f07841 sd-dhcp-lease: fix memleaks
(cherry picked from commit e2975f854831d08a25b4f5eb329b6d04102e115f)
(cherry picked from commit 157094abd8)
(cherry picked from commit 3fd9d11619)
2018-10-29 18:42:38 +01:00
Evgeny Vereshchagin
0f25f47767 dhcp6: fix an off-by-one error in dhcp6_option_parse_domainname
==14==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200055fa9c at pc 0x0000005458f1 bp 0x7ffc78940d90 sp 0x7ffc78940d88
READ of size 1 at 0x60200055fa9c thread T0
    #0 0x5458f0 in dhcp6_option_parse_domainname /work/build/../../src/systemd/src/libsystemd-network/dhcp6-option.c:555:29
    #1 0x54706e in dhcp6_lease_set_domains /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-lease.c:242:13
    #2 0x53fce0 in client_parse_message /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-client.c:984:29
    #3 0x53f3bc in client_receive_advertise /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-client.c:1083:13
    #4 0x53d57f in client_receive_message /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-client.c:1182:21
    #5 0x7f0f7159deee in source_dispatch /work/build/../../src/systemd/src/libsystemd/sd-event/sd-event.c:3042:21
    #6 0x7f0f7159d431 in sd_event_dispatch /work/build/../../src/systemd/src/libsystemd/sd-event/sd-event.c:3455:21
    #7 0x7f0f7159ea8d in sd_event_run /work/build/../../src/systemd/src/libsystemd/sd-event/sd-event.c:3512:21
    #8 0x531f2b in fuzz_client /work/build/../../src/systemd/src/fuzz/fuzz-dhcp6-client.c:44:9
    #9 0x531bc1 in LLVMFuzzerTestOneInput /work/build/../../src/systemd/src/fuzz/fuzz-dhcp6-client.c:53:9
    #10 0x57bec8 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:570:15
    #11 0x579d67 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/libfuzzer/FuzzerLoop.cpp:479:3
    #12 0x57dc92 in fuzzer::Fuzzer::MutateAndTestOne() /src/libfuzzer/FuzzerLoop.cpp:707:19
    #13 0x580ca6 in fuzzer::Fuzzer::Loop(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /src/libfuzzer/FuzzerLoop.cpp:838:5
    #14 0x55e968 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:764:6
    #15 0x551a1c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #16 0x7f0f701a082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #17 0x41e928 in _start (/out/fuzz-dhcp6-client+0x41e928)

https://github.com/systemd/systemd/pull/10200
b387d3c132
(cherry picked from commit 7cb7cffc49)
(cherry picked from commit cd3aacefdd)
(cherry picked from commit 5b140a77bc)
2018-10-29 18:41:23 +01:00
Thomas Haller
1031b2bb5c systemd/dhcp: fix assertion starting DHCP client without MAC address
An assertion in dhcp_network_bind_raw_socket() is triggered when
starting an sd_dhcp_client without setting setting a MAC address
first.

  - sd_dhcp_client_start()
    - client_start()
      - client_start_delayed()
        - dhcp_network_bind_raw_socket()

In that case, the arp-type and MAC address is still unset. Note that
dhcp_network_bind_raw_socket() already checks for a valid arp-type
and MAC address below, so we should just gracefully return -EINVAL.

Maybe sd_dhcp_client_start() should fail earlier when starting without
MAC address. But the failure here will be correctly propagated and
the start aborted.

See-also: https://github.com/systemd/systemd/pull/10054
(cherry picked from commit 34af574d58)
(cherry picked from commit 0a797bdc2a)
(cherry picked from commit f37ed84ca4)
2018-10-29 18:38:39 +01:00
Thomas Haller
d1e62e59f6 libnm: fix crash in activate_info_complete() when cancelling
We must disconnect ActivateInfo before invoking callbacks.

Otherwise, it can happen that the callee cancels the cancellable,
which in turn enters activate_info_complete() again, and leads
to a crash.

https://bugzilla.redhat.com/show_bug.cgi?id=1642625
(cherry picked from commit ec37e18c64)
(cherry picked from commit 2c6fafad7a)
(cherry picked from commit 3d23e9d68f)
2018-10-25 15:32:13 +02:00
Beniamino Galvani
1e486a721d dns: merge branch 'bg/dns-1-10'
https://github.com/NetworkManager/NetworkManager/pull/235
https://bugzilla.gnome.org/show_bug.cgi?id=746422
2018-10-19 18:53:36 +02:00
Beniamino Galvani
58bb588fbe libnm-core: fix validation of connection.mdns setting
Commit 9d92848ada ("libnm: rename MDns flag UNKNOWN to DEFAULT")
changed the enum order without updating verify().

Fixes: 9d92848ada
(cherry picked from commit 0498c5487f)
2018-10-19 18:39:35 +02:00
Beniamino Galvani
be483778e7 dns: dnsmasq: avoid crash when no reverse domains exist
ip_data->domains.reverse can be NULL when the device is being removed
and has no IP configuration for a short moment.

Fixes: 6409e7719c

https://bugzilla.gnome.org/show_bug.cgi?id=797022
(cherry picked from commit f0c075f050)
(cherry picked from commit 8309a7a696)
2018-10-19 18:39:35 +02:00
Beniamino Galvani
6b8c6e891b dns: merge branch 'bg/dns-bgo746422'
https://bugzilla.gnome.org/show_bug.cgi?id=746422
(cherry picked from commit d978258924)
2018-10-19 18:39:34 +02:00
Beniamino Galvani
7d4c7e73df dns: merge branch 'bg/dns-domains-pt1-bgo746422'
https://bugzilla.gnome.org/show_bug.cgi?id=746422
(cherry picked from commit b2f306ac3d)
2018-10-19 18:39:34 +02:00
Beniamino Galvani
107c7f27af libnm-core: document dns priority
(cherry picked from commit 1fbadecdbc)
2018-10-19 18:39:34 +02:00
Beniamino Galvani
4e9555699d dns: sd-resolved: honor dns-priority
Honor dns-priority by using the preprocessed list of domains provided
by the manager.

(cherry picked from commit 5df69330b5)
2018-10-19 18:39:34 +02:00
Beniamino Galvani
bd1021a0a0 dns: dnsmasq: honor dns-priority
Honor dns-priority by using the preprocessed list of domains provided
by the manager.

(cherry picked from commit 6409e7719c)
2018-10-19 18:39:34 +02:00
Beniamino Galvani
ad98a41399 dns: fix compilation error
Fixes the following error when building with gcc 4.8.5 and address
sanitizer:

src/dns/nm-dns-dnsmasq.c: In function 'update':
src/dns/nm-dns-dnsmasq.c:506:44: error: 'first_prio' may be used uninitialized in this function [-Werror=maybe-uninitialized]
    } else if (first_prio < 0 && first_prio != prio)
                                            ^

(cherry picked from commit 10ef61408e)
2018-10-19 18:39:34 +02:00
Beniamino Galvani
ad0400408e dns: use dns-priority to provide a preprocessed domain list to plugins
Do some preprocessing on the DNS configuration sent to plugins:

 - add the '~' default routing (lookup) domain to IP configurations
   with the default route or, when there is none, to all non-VPN
   IP configurations

 - use the dns-priority to decide which connection to use in case
   multiple connections have the same domain

 - consider a negative dns-priority value as a way to 'shadow' all
   subdomains from other connections

 - compute reverse DNS domains

and add the resulting domain list to NMDnsIPConfigData so that
split-DNS plugins can use that directly instead of reimplementing the
same logic themselves.

(cherry picked from commit dd1e671fe5)
2018-10-19 18:39:34 +02:00
Beniamino Galvani
f853788290 core: reject invalid domains from ip configurations
Reject domains containing ".." or starting with "."

(cherry picked from commit 82ebfa7351)
2018-10-19 18:39:34 +02:00
Beniamino Galvani
6a0e5fdd47 dns: dnsmasq: fix adding multiple domains
Fixes: e91f1a7d2a
(cherry picked from commit 14b6e330e2)
2018-10-19 18:39:34 +02:00
Beniamino Galvani
fb81b0bccc all: merge branch 'th/policy-and-mdns'
https://github.com/NetworkManager/NetworkManager/pull/44
(cherry picked from commit 5eea9be983)
2018-10-19 18:39:33 +02:00
Beniamino Galvani
3422988c2a dns: introduce routing domains
Similarly to what systemd-resolved does, introduce the concept of
"routing" domain, which is a domain in the search list that is used
only to decide the interface over which a query must be forwarded, but
is not used to complete unqualified host names. Routing domains are
those starting with a tilde ('~') before the actual domain name.

Domains without the initial tilde are used both for completing
unqualified names and for the routing decision.

(cherry picked from commit e91f1a7d2a)
2018-10-19 18:39:33 +02:00
Thomas Haller
427c978e30 policy: merge IPv4 and IPv6 versions of device_ip_config_changed()
(cherry picked from commit d1de905ed3)
2018-10-19 18:39:33 +02:00
Beniamino Galvani
f144eac12c dns: systemd-resolved: use generic ip-config functions
(cherry picked from commit 42ea86fb7a)
2018-10-19 18:39:33 +02:00
Thomas Haller
d7ebbd69a0 core: implement setting MDNS setting for systemd
The connection.mdns setting is a per-connection setting,
so one might expect that one activated device can only have
one MDNS setting at a time.

However, with certain VPN plugins (those that don't have their
own IP interface, like libreswan), the VPN configuration is merged
into the configuration of the device. So, in this case, there
might be multiple settings for one device that must be merged.

We already have a mechanism for that. It's NMIP4Config. Let NMIP4Config
track this piece of information. Although, stricitly speaking this
is not tied to IPv4, the alternative would be to introduce a new
object to track such data, which would be a tremendous effort
and more complicated then this.

Luckily, NMDnsManager and NMDnsPlugin are already equipped to
handle multiple NMIPConfig instances per device (IPv4 vs. IPv6,
and Device vs. VPN).

Also make "connection.mdns" configurable via global defaults in
NetworkManager.conf.

(cherry picked from commit c03a534963)
2018-10-19 18:39:33 +02:00
Beniamino Galvani
d4ca953620 dns: export search list in the D-Bus "domain" attribute
The "domain" key of the D-Bus configuration dictionary specifies the
domains a configuration applies to. In DNS code we consider domains
and searches as equivalent, so they should be exported via D-Bus using
the same logic used to populate resolv.conf and for plugins.

(cherry picked from commit 70550e2740)
2018-10-19 18:39:33 +02:00
Thomas Haller
fd5550e97c core: rework tracking config in dns-manager to use ifindex
Don't track the per-device configuration in NMDnsManager by
the ifname, but by the ifindex. We should consistently treat
the ifindex as the ID of a link, like kernel does.

At the few places where we actually need the ifname, resolve
it by looking into the platform cache. That is not necessarily
the same as the ifname that is currently tracked by NMDevice,
because netdev interfaces can be renamed, and NMDevice updates
it's link properties delayed. However, the platform cache has
the most recent notion of the correct interface name for an
ifindex, so if we ever hit a race here, we do it now more
correctly.

This also temporarily drops support for mdns. Will be re-added next,
but differently.

(cherry picked from commit b40729ca5f)
2018-10-19 18:39:33 +02:00
Beniamino Galvani
f43febc2ab dns: add @dup argument to add_dns_domains() and add_string_item()
Add a @dup argument that tells whether the new item should be
duplicated.

(cherry picked from commit b4db0e8362)
2018-10-19 18:39:33 +02:00
Beniamino Galvani
0daa4db81b dns: split out domains retrieval
(cherry picked from commit e78bfb63cd)
2018-10-19 18:39:33 +02:00
Thomas Haller
e4270341ca core/trivial: rename local variable in merge_one_ip_config()
Next commit will unify naming of variables, do a trivial rename
first to make the diff smaller.

(cherry picked from commit fc40d91b97)
2018-10-19 18:39:32 +02:00
Thomas Haller
9d5be62ffa dns: rework pending request-queue in NMDnsSystemdResolved
We had two separate queues, one for "SetLinkDNS" and one for
"SetLinkDomains". Merge them into one, and track the operation
as part of the new RequestItem structure.

A visible change to before is that we now would make all requests
per-interface first. Prevously, we would first make all SetLinkDNS
requests (for all interfaces) and then all SetLinkDomains requests.
It feels more correct to order the requests this way, not by
type.

The reason to merge is, that we will next get another operation
and in the current scheme we would need 3 GQueue instances.

While at it, refactor the code to use CList. We now anyway would
need a new struct to track the operation, requiring to allocate
and free it. Previously, we would only track the GVariant argument
as data of the GQueue.

(cherry picked from commit b0f1a54c9b)
2018-10-19 18:39:32 +02:00
Thomas Haller
2642407dc2 dns: refactor update() in NMDnsSystemdResolved to use a hash table
Use a GHashTable instead of a GArray to construct the list of
@interfaces. Also, use NMCListElem instead of GList. With this,
the runtime is O(n*log(n)) instead of O(n^2).

I belive, we should take care that all our code has a reasonable
runtime complexity, even in common use-cases the number of elements
is small. This is not about performace, because likely we expect few
entries anyway, and the direct GArray implementation is likely faster
in those cases. It's about using the data structure that best suits the
access pattern.

The log(n) part comes from sorting the keys. I also believe we should
always aim for a stable behavior. When sending the D-Bus request to
resolved, the order of elements should be in ~some~ defined order.

(cherry picked from commit 4be4a3c21f)
2018-10-19 18:39:32 +02:00
Thomas Haller
f2590e86b3 shared: add nm_cmp_int2ptr_p_with_data() helper
A cmp() implementation, for sorting an array with pointers, where each
pointer is an inteter according to GPOINTER_TO_INT().

That cames for example handy, if you have a GHashTable with keys
GINT_TO_POINTER(). Then you get the list of keys via
g_hash_table_get_keys_as_array() and want to sort them.

(cherry picked from commit 901aa0315b)
2018-10-19 18:39:32 +02:00
Thomas Haller
fb64e268bb shared: add NMCListElem
Sometimes, we want to use CList to track a simple data item. But contrary
to GList/GSList, we need to define a structure to hold the data pointer
and the CList member.

Add a generic NMCListElem type that can be used for such simple uses.

Before you ask: why not use GList/GSList? Because even simple operations
like g_list_append() is O(n), which kinda defeats the purpose of having
a doubly linked list.

This code is added to a new header file nm-c-list.h, the reason is that
there is no other good place:
  - "nm-utils/c-list.h" is a clone of upstream, it should not deviate.
  - "nm-utils/c-list-util.h" contains our utils functions for c-list.h
    but should be plain C, independent of glib.
  - "nm-utils/nm-shared-utils.h" contains our glib related utilities,
    but it should not drag in "c-list.h".
So, "nm-c-list.h" is a utility libray that extends "c-list.h" and
requires glib.

(cherry picked from commit 2aad517b0b)
2018-10-19 18:39:32 +02:00
Thomas Haller
0d3f19774f core: add nm_ip_config_get_ifindex() helper
(cherry picked from commit 4ccfa7a79a)
2018-10-19 18:39:32 +02:00
Thomas Haller
8aea6745c4 dns: merge IPv4 and IPv6 versions of add_ip_config() (part 2)
(cherry picked from commit 7d4def2764)
2018-10-19 18:39:32 +02:00