Includes subject_match and phase2_subject_match (string) parameters,
and altsubject_matches and phase2_altsubject_matches (list of string)
parameters.
subject_match is matched against a substring of the subject from the
certificate presented by the remote authentication server. If this
option is unset, no subject verification is performed.
altsubject_matches are each tested against the alternate subject name
(altSubjectName) of the certificate presented by the remote
authentication server. If this option is unset, no verification of the
altSubjectName is performed.
When new services are installed and the daemon reloads bus policy
(like when installing new VPN plugins with rpm or dpkg) it appears
the rules don't get loaded into NetworkManager's policy space.
Thus any D-Bus message NM sends to the newly installed VPN plugin
gets denied until a restart of NM or the machine. Work around
this dbus bug by letting NM talk to all known VPN services in the
NM policy file which will always exist when NM is around.
NMRemoteSettings's constructor requires a DBusGConnection, but there
currently aren't any usable gobject-introspection bindings for that class.
This means that NMRemoteSettings can't be used over gobject-introspection.
Move the default fallback to the system bus into the constructor path, so
that introspection bindings are usable.
Python test case:
from gi.repository import NMClient
NMClient.RemoteSettings()
Before, this produced a segfault. Now it returns a usable RemoteSettings
object.
Once we've sent a method call over DBus requesting that the modem be
disabled, we should assume that the modem is disabled unless we hear
otherwise. Otherwise, code that checks the modem state immediately
after it gets disabled might think that it's enabled when it almost
certainly is not.
Normally, a device disabled via nm_device_interface_set_enabled() will
shift into the UNAVAILABLE state. Modems, however, don't do that.
Rather, they pretend that they are in the DISCONNECTED state, presumably
to make it easier to re-enable them. To avoid accidentally re-enabling
and autoconnecting a disabled modem, we need to explicitly make
nm_device_interface_get_enabled() == true a prerequisite for
autoconnecting.
The core problem was that the Update would trigger a write to
disk to save the connection's new settings, which called
nm_settings_connection_replace_settings(). Which saved existing
transient (agent/unsaved) secrets, replaced settings with the
new ones from Update(), then copied back the old transient
secrets. This was to ensure that changes triggered from getting
agent secrets during activation (which might write the connection
out to disk if new system secrets were provided, which triggered
an inotify read-back of the connection, which blew away the
transient secrets just returned from the agent) didn't blow away
transient secrets. Unfortunately that fix was too general.
As a quick hack for now, copy the new secrets and re-apply them
after nm_connection_replace_settings() has run. We'll do the
actual fix later, but it's more involved and needs more testing
so we don't want to apply it this close to release.
Changing NM_CONTROLED from "no" to "yes" worked just the first time.
Fix that by storing unmanaged spec when interface becomes unmanaged
and adjust condition identifying "no-change" updates to the ifcfg
file.
Chain up to parent's commit_changes() even if in-memory and on-disk data are the
same; they are the same when another process changes the on-disk file. Just make
sure not to write out the data needlessly when same.
This fixes a regression caused by 9cba854fa0.
It exhibits e.g. by not auto-activating connection when ONBOOT is changed from
"no" to "yes". Connection "updated" signal was not emitted and listeners like
NMPolicy was not prodded.
The DBus signatures registered (via dbus_g_proxy_add_signal) for the
fi.w1.wpa_supplicant.Interface.{BSSAdded,ScanDone} signals were
incorrect. That prevented us from receiving wifi ap scan results, at
least in the case where wpa_supplicant has DBus introspection disabled.
There's two possibilities for errors from D-Bus when trying to
activate the supplicant; either we ignore the error and wait
for the supplicant to restart or be started, or it's a hard
error and we can't continue without risking worse behavior (ie
out of memory, supplicant spawns but exits immediately, etc).
This adds a few more harmless errors to the first category
which can happen if the supplicant's .service file exists
but the supplicant does not, in which case we just wait for
it to magically show up later.
Allow IPv6 connections to fail by changing the default value of the may-fail
property for ipv6 settings to TRUE.
This makes sure connections created manually using nm-connection-editor
will default to having the "Require ..." checkbox unchecked; in other words,
IPv6 timing out will still allow the interface to be configured if
IPv4 succeeds.
The regex was capturing integers larger than 3 digits, which aren't
valid SSID integer list items because each byte of the SSID cannot be
larger than 255. Add an explicit testcase for intlist SSIDs too.
The previous regex was causing a testcase failure with an SSID of
'1337' which it was interpreting as a single element intlist, but
should have been interpreted as a string since it's clear > 255.
The export check looks for symbols that begin with "nm_" (except
for GObject class stuff) which indicate that the symbol should be
exported. If the symbols is 'l' (local) as reported by objdump
that probably means we forgot to add it to the .ver file and it
really should be exported. nm_gvalue_dup() shouldn't be exported
though, so rename it such that it's obviously internal.
When secrets are flagged as agent-owned in a connection configuration file, but
actually not available, we have to return an empty hash (nm_connection_to_hash()
returns NULL).
It's not a valid prefix since NM determines the default routes
automatically, and thus routes and addresses with a prefix of
zero should not be used in config files.
