Commit graph

32637 commits

Author SHA1 Message Date
Beniamino Galvani
524febf271 docs: document the hostname management workflow
(cherry picked from commit 543ebef32b)
(cherry picked from commit 9f09d4d364)
(cherry picked from commit ff81488583)
2024-08-19 17:14:34 +02:00
Beniamino Galvani
cfe840784c core: also use /etc/hosts for hostname resolution
Before introducing the hostname lookup via nm-daemon-helper and
systemd-resolved, we used GLib's GResolver which internally relies on
the libc resolver and generally also returns results from /etc/hosts.

With the new mechanism we only ask to systemd-resolved (with
NO_SYNTHESIZE) or perform the lookup via the "dns" NSS module. In both
ways, /etc/hosts is not evaluated.

Since users relied on having the hostname resolved via /etc/hosts,
restore that behavior. Now, after trying the resolution via
systemd-resolved and the "dns" NSS module, we also try via the "files"
NSS module which reads /etc/hosts.

Fixes: 27eae4043b ('device: add a nm_device_resolve_address()')
(cherry picked from commit 410afccb32)
(cherry picked from commit cb54fe7ce9)
(cherry picked from commit e3861be845)
2024-08-19 17:14:26 +02:00
Beniamino Galvani
717db10a9d nm-daemon-helper: add "service" argument
Introduce a new argument to specify a comma-separated list of NSS
services to use for the "resolve-address" command. For now only accept
"dns" and "files"; the latter can be used to do a lookup into
/etc/hosts.

Note that previously the command failed in presence of extra
arguments. Therefore, when downgrading NetworkManager without
restarting the service, the previously-installed version of the daemon
(newer) would spawn the helper with the extra argument, and the
newly-installed version of the helper (older) would fail. This issue
only impacts hostname resolution and can be fixed by just restarting
the daemon.

In the upgrade path everything works as before, with the only
difference that the helper will use by default both "dns" and "files"
services.

Don't strictly check for the absence of extra arguments, so that in
the future we can introduce more arguments without necessarily break
the downgrade path.

(cherry picked from commit 229bebfae9)
(cherry picked from commit c36a74f698)
(cherry picked from commit e86ddd9fc5)
2024-08-19 17:14:15 +02:00
Fernando Fernandez Mancera
cf75343da9 merge: branch 'th/lldp-fix-crash'
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2007

(cherry picked from commit 79c1f8c93a)

(cherry picked from commit 62d745fc9f)

(cherry picked from commit 90edd623ad)
2024-08-19 15:39:24 +02:00
Thomas Haller
e16ba29286 lldp: fix multiple access to argument in logging macro
Fixes: 630de288d2 ('lldp: add libnm-lldp as fork of systemd's sd_lldp_rx')
(cherry picked from commit 4365de5226)
(cherry picked from commit a1c18ce20d)
(cherry picked from commit 9905bcdcb7)
2024-08-19 15:39:24 +02:00
Thomas Haller
48fa8dacf1 lldp: fix crash dereferencing NULL pointer during debug logging
During nm_lldp_neighbor_parse(), the NMLldpNeighbor is not yet added to
the NMLldpRX instance. Consequently, n->lldp_rx is NULL.

Note how we use lldp_x for logging, because we need it for the context
for which interface the logging statement is.

Thus, those debug logging statements will follow a NULL pointer and lead
to a crash.

Fixes: 630de288d2 ('lldp: add libnm-lldp as fork of systemd's sd_lldp_rx')

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1550
(cherry picked from commit c2cddd3241)
(cherry picked from commit 8a2f7bd6e0)
(cherry picked from commit 6da9b98975)
2024-08-19 15:39:24 +02:00
Fernando Fernandez Mancera
39716201dc ovs: fix triggering stage3 activation without DHCP client initialized
It is possible that we learn the link is ready on stage3_ip_config
rather than in link_changed event due to a stage3_ip_config scheduled by
another component. In such cases, we proceed with IP configuration
without allocating the resources needed like initializing DHCP client.

In order to avoid that, if we learn during stage3_ip_config that the
link is now ready, we need to schedule another stage3_ip_config to
allocate the resources we might need.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2004

Fixes: 83bf7a8cdb ('ovs: wait for the link to be ready before activating')
(cherry picked from commit 40d51b9104)
(cherry picked from commit 63dfd3b60b)
(cherry picked from commit f8f5626f72)
2024-07-31 11:10:10 +02:00
Fernando Fernandez Mancera
dbc455a25e ovs: wait for the link to be ready before activating
When activating an ovs-interface we already wait for the cloned MAC
address to be set, ifindex is present and platform link also present but
in some cases this is not enough.

If an udev rule is in place it might modify the interface when it is in
a later stage of the activation causing some race conditions or
problems. In order to solve that, we must wait until the link is fully
initialized.

(cherry picked from commit 83bf7a8cdb)
(cherry picked from commit 00e178351b)
(cherry picked from commit 6328a1a0d1)
2024-07-25 10:43:44 +02:00
Gris Ge
dc3618b027 activation: Allow changing controller of exposed active connection
When activating a port with its controller deactivating by new
activation, NM will register `state-change` signal waiting controller to
have new active connections. Once controller got new active connection,
the port will invoke `nm_active_connection_set_controller()` which lead
to assert error on
    g_return_if_fail(!nm_dbus_object_is_exported(NM_DBUS_OBJECT(self)))

because this active connection is already exposed as DBUS object.

To fix the problem, we remove the restriction on controller been
write-only and notify DBUS object changes for controller property.

Signed-off-by: Gris Ge <fge@redhat.com>
(cherry picked from commit 83a2595970)
(cherry picked from commit 3f3d1a4f54)
(cherry picked from commit 79c81fc06a)
2024-07-19 15:29:21 +02:00
Beniamino Galvani
4377b47cf2 crypto: regenerate PKCS#12 certificates
The PKCS#12 certificates are using SHA1 and RC2-40, which are deprecated;
regenerate them with:

 $ openssl pkcs12 -export -in test_key_and_cert.pem -inkey test_key_and_cert.pem -certfile test_ca_cert.pem -name "test-pkcs12" -out test-cert.p12
 (key: test)

 $ openssl pkcs12 -export -in test2_key_and_cert.pem -inkey test2_key_and_cert.pem -certfile test2_ca_cert.pem -name "test2-pkcs12" -out test2-cert.p12
 (key: 12345testing)

Before:
 $ openssl pkcs12 -info -in test-cert.p12
 MAC: sha1, Iteration 2048
 MAC length: 20, salt length: 8
 PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048

After:
 $ openssl pkcs12 -info -in test-cert.p12
 MAC: sha256, Iteration 2048
 MAC length: 32, salt length: 8
 PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256
(cherry picked from commit 0d657af256)
2024-06-28 13:20:45 +02:00
Beniamino Galvani
01a03c7a5a release.sh: update version check
(cherry picked from commit cfc3f3fed7)
(cherry picked from commit 39c0e8cf30)
2024-06-24 13:42:30 +02:00
Beniamino Galvani
cb36b8507f libnm-core: fix memory leak in nm_setting_to_string()
Fixes: f957ea2b34 ('core/setting: rework nm_connection_dump()')

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1934
(cherry picked from commit ee5f4402bf)
(cherry picked from commit a9d7554a02)
(cherry picked from commit e17e207b3c)
2024-06-19 14:44:26 +02:00
Gris Ge
d81852e87d checkpoint: fix port reactivation when controller is deactivating
Problem:

    Given a OVS port with `autoconnect-ports` set to default or false,
    when reactivation required for checkpoint rollback,
    previous activated OVS interface will be in deactivate state after
    checkpoint rollback.

The root cause:

    The `activate_stage1_device_prepare()` will mark the device as
    failed when controller is deactivating or deactivated.
    In `activate_stage1_device_prepare()`, the controller device is
    retrieved from NMActiveConnection, it will be NULL when NMActiveConnection
    is in deactivated state. This will cause device been set to
    `NM_DEVICE_STATE_REASON_DEPENDENCY_FAILED` which prevent all follow
    up `autoconnect` actions.

Fix:
    When noticing controller is deactivating or deactivated with reason
    `NM_DEVICE_STATE_REASON_NEW_ACTIVATION`, use new function
    `nm_active_connection_set_controller_dev()` to wait on controller
    device state between NM_DEVICE_STATE_PREPARE and
    NM_DEVICE_STATE_ACTIVATED. After that, use existing
    `nm_active_connection_set_controller()` to use new
    NMActiveConnection of controller to move on.

Resolves: https://issues.redhat.com/browse/RHEL-31972

Signed-off-by: Gris Ge <fge@redhat.com>
(cherry picked from commit a68d2fd780)
(cherry picked from commit 4726822fb0)
(cherry picked from commit 91f63030b1)
2024-06-01 17:21:29 +02:00
Thomas Haller
d7fd7f993f core: workaround "-Wnonnull-compare" warning in nm_lldp_neighbor_tlv_get_oui()
../src/libnm-lldp/nm-lldp-neighbor.c: In function ‘nm_lldp_neighbor_tlv_get_oui’:
  ../src/libnm-std-aux/nm-std-aux.h:191:12: error: ‘nonnull’ argument ‘oui’ compared to NULL [-Werror=nonnull-compare]
    191 |         if (expr)                      \
        |            ^
  ../src/libnm-std-aux/nm-std-aux.h:202:27: note: in expansion of macro ‘_NM_BOOLEAN_EXPR_IMPL’
    202 |                           _NM_BOOLEAN_EXPR_IMPL(NM_UNIQ, expr))
        |                           ^~~~~~~~~~~~~~~~~~~~~
  ../src/libnm-glib-aux/nm-macros-internal.h:1693:31: note: in expansion of macro ‘NM_BOOLEAN_EXPR’
   1693 | #define _G_BOOLEAN_EXPR(expr) NM_BOOLEAN_EXPR(expr)
        |                               ^~~~~~~~~~~~~~~
  /usr/include/glib-2.0/glib/gmacros.h:1244:43: note: in expansion of macro ‘_G_BOOLEAN_EXPR’
   1244 | #define G_LIKELY(expr) (__builtin_expect (_G_BOOLEAN_EXPR(expr), 1))
        |                                           ^~~~~~~~~~~~~~~
  /usr/include/glib-2.0/glib/gmessages.h:661:9: note: in expansion of macro ‘G_LIKELY’
    661 |     if (G_LIKELY (expr)) \
        |         ^~~~~~~~
  ../src/libnm-lldp/nm-lldp-neighbor.c:651:5: note: in expansion of macro ‘g_return_val_if_fail’
    651 |     g_return_val_if_fail(oui, -EINVAL);
        |     ^~~~~~~~~~~~~~~~~~~~

(cherry picked from commit a500538fb2)
(cherry picked from commit 3f3f446f6e)
2024-06-01 17:21:23 +02:00
Beniamino Galvani
31fcb67dcd merge: branch 'bg/rollback-in-memory'
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1920
(cherry picked from commit a0f798342a)
(cherry picked from commit 172278bbd7)
2024-05-23 14:26:42 +02:00
Beniamino Galvani
89657706e0 checkpoint: preserve in-memory state of connections
If a connection is in-memory (i.e. has flag "unsaved"), after a
checkpoint and rollback it can be wrongly persisted to disk:

 - if the connection was modified and written to disk after the
   rollback, during the rollback we update it again with persist mode
   "keep", which keeps it on disk;

 - if the connection was deleted after the rollback, during the
   rollback we add it again with persist mode "to-disk".

Instead, remember whether the connection had the "unsaved" flag set
and try to restore the previous state.

However, this is not straightforward as there are 4 different possible
states for the settings connection: persistent; in-memory only;
in-memory shadowing a persistent file; in-memory shadowing a detached
persistent file (i.e. the deletion of the connection doesn't delete
the persistent file). Handle all those cases.

Fixes: 3e09aed2a0 ('checkpoint: add create, rollback and destroy D-Bus API')
(cherry picked from commit c979bfeb8b)
(cherry picked from commit ebf25794d9)
2024-05-23 14:26:09 +02:00
Beniamino Galvani
e087ca4883 settings: add nm_settings_connection_persist_mode_to_string()
(cherry picked from commit a48b7fe7b9)
(cherry picked from commit e5837aa1d3)
2024-05-23 14:25:29 +02:00
Wen Liang
546dd70178 device: use subnet when the applied connection has IPv6 method shared
We should use the IPv6 subnet when we have an applied connection
stored on the downlink device, and the IPv6 method should be "shared"
for that applied connection. It does not make sense to register l3cd
and set router config for ndisc instance when the downlink device is
already deactivated.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1880
Resolves: https://issues.redhat.com/browse/RHEL-17350

Signed-off-by: Wen Liang <liangwen12year@gmail.com>
(cherry picked from commit 15901a7489)
(cherry picked from commit 86fbfb3806)
2024-05-02 15:02:36 +02:00
Thomas Haller
8d32bd3883 l3cfg: handle dynamic added routes tracking and deletion
Dynamic added routes i.e ECMP single-hop routes, are not managed by l3cd
as the other ones. Therefore, they need to be tracked properly and
marked as dirty when they are.

Without this, the state of those ECMP single hop routes is not properly
tracked, and they are for example not removed by NML3Cfg when they
should.

Usually, routes to be configured originate from the combined
NML3ConfigData and are resolved early during a commit. For example,
_obj_states_update_all() creates for each such route an obj_state_hash
entry. Let's call those static, or "non-dynamic".

Later, we can receive additional routes. We get them back from NMNetns
during nm_netns_ip_route_ecmp_commit() (_commit_collect_routes()).
Let's call them "dynamic".

For those routes, we also must track an obj-state.

Now we have two reasons why an obj-state is tracked. The "non-dynamic"
and the "dynamic" one. Add two flags "os_dynamic" and "os_non_dynamic"
to the ObjStateData and consider the flags at the necessary places.

Co-authored-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
(cherry picked from commit 5d26452da5)
2024-04-19 14:27:55 +02:00
Fernando Fernandez Mancera
bdf82097db l3cfg: factor out _obj_state_data_new() for creating object state
Will be used next.

(cherry picked from commit ffe22c498f)
2024-04-19 14:27:49 +02:00
Thomas Haller
8cb1cf176b core: assert that tracked objects in NML3Cfg don't have metric_any
It wouldn't work otherwise. The object state is used to track routes
and compare them to what we find in platform.

A "metric_any" is useful at higher layers, to track a route where the
metric is decided by somebody else. But at the point when we add such an
object to the object-state, a fixed metric must be chosen.

Assert for that.

(cherry picked from commit 8d205faa46)
2024-04-19 14:27:44 +02:00
Fernando Fernández Mancera
c42ef1212f merge: branch 'nm-1-44-ovs-vlan'
[nm 1.44] ovs: Do not allow OVS bridge and port to be parent

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1916
2024-04-08 09:40:13 +00:00
Gris Ge
e8aff94cef ovs: Do not allow OVS bridge and port to be parent
When creating VLAN over OVS internal interface which holding the same
name as its controller OVS bridge, NetworkManager will fail with error:

    Error: Connection activation failed: br0.101 failed to create
    resources: cannot retrieve ifindex of interface br0 (Open vSwitch
    Bridge)

Expanded the `find_device_by_iface()` with additional argument
`child: NmConnection *` which will validate whether candidate is
suitable to be parent device.

In `nm_device_check_parent_connection_compatible()`, we only not allow OVS
bridge and OVS port being parent.

Resolves: https://issues.redhat.com/browse/RHEL-26753

Signed-off-by: Gris Ge <fge@redhat.com>
(cherry picked from commit 7096f52a59)
(cherry picked from commit d3329f0599)
2024-04-08 16:37:44 +08:00
Fernando Fernandez Mancera
34b2f89904 libnm-lldp: use ETH_P_ALL instead of NM_ETHERTYPE_LLDP for the socket
When creating the socket for listening to LLDP frames we are setting
NM_ETHERTYPE_LLDP (0x88cc) as protocol. In most of the cases, that is
correct but when the interface is attached as a port to a OVS bridge,
kernel is not matching the protocol correctly. The reason might be that
some metadata is added to the packet, but we are not completely sure
about it.

Instead, we should use ETH_P_ALL to match all the protocols. Later, we
have a eBPF filter to drop the packet by multicast MAC address or
protocol. This is how lldpd is doing it for example.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1903
(cherry picked from commit 9ac1d6e22b)
(cherry picked from commit 2fac176986)
2024-04-05 11:57:30 +02:00
Gris Ge
118579c6de checkpoint: Allow rollback on internal global DNS
With `NM_CHECKPOINT_CREATE_FLAG_TRACK_INTERNAL_GLOBAL_DNS` flag set on
checkpoint creation, the checkpoint rollback will restore the
global DNS in internal configure file
`/var/lib/NetworkManager/NetworkManager-intern.conf`.

If user has set global DNS in /etc folder, this flag will not take any
effect.

Resolves: https://issues.redhat.com/browse/RHEL-23446

Signed-off-by: Gris Ge <fge@redhat.com>
(cherry picked from commit 86d67da28d)
(cherry picked from commit 69d5761fa8)
2024-03-20 20:03:24 +01:00
Beniamino Galvani
efbdaa8c6a release: bump version to 1.44.5 (development) 2024-03-15 09:24:36 +01:00
Beniamino Galvani
b14001c659 release: bump version to 1.44.4 2024-03-15 09:24:36 +01:00
Beniamino Galvani
ac2f2a8611 NEWS: update 2024-03-14 09:23:21 +01:00
Beniamino Galvani
d1191b2d25 nmcli: fix crash in nmc_connection_check_deprecated()
It's not clear in which circumstances, but 'type' can be NULL as in
the following backtrace:

  nmc_connection_check_deprecated (c=c@entry=0x55d93f937610) at src/nmcli/connections.c:676
  connection_warnings (nmc=nmc@entry=0x55d93f5ae5e0 <nm_cli>, connection=connection@entry=0x55d93f937610) at src/nmcli/connections.c:5464
  add_connection_cb (client=<optimized out>, result=<optimized out>, user_data=0x55d93fc83820) at src/nmcli/connections.c:5510
  g_task_return_now (task=0x55d93fc86fd0 [GTask]) at ../gio/gtask.c:1361
  g_task_return (type=<optimized out>, task=0x55d93fc86fd0 [GTask]) at ../gio/gtask.c:1430
  g_task_return (task=0x55d93fc86fd0 [GTask], type=<optimized out>) at ../gio/gtask.c:1387
  _request_wait_complete () at /lib64/libnm.so.0
  _nm_client_notify_event_emit_parts () at /lib64/libnm.so.0
  _dbus_handle_changes_commit () at /lib64/libnm.so.0
  _nm_client_get_settings_call_cb () at /lib64/libnm.so.0
  _nm_client_dbus_call_simple_cb () at /lib64/libnm.so.0
  g_task_return_now (task=0x55d93f7bd6f0 [GTask]) at ../gio/gtask.c:1361
  g_task_return (type=<optimized out>, task=0x55d93f7bd6f0 [GTask]) at ../gio/gtask.c:1430
  g_task_return (task=0x55d93f7bd6f0 [GTask], type=<optimized out>) at ../gio/gtask.c:1387
  g_dbus_connection_call_done (source=<optimized out>, result=<optimized out>, user_data=0x55d93f7bd6f0) at ../gio/gdbusconnection.c:5895
  g_task_return_now (task=0x55d93f7bd7b0 [GTask]) at ../gio/gtask.c:1361
  complete_in_idle_cb (task=task@entry=0x55d93f7bd7b0) at ../gio/gtask.c:1375
  g_idle_dispatch (source=0x7f15b007c940, callback=0x7f15ca7e4850 <complete_in_idle_cb>, user_data=0x55d93f7bd7b0) at ../glib/gmain.c:6150
  g_main_dispatch (context=0x55d93f77cde0) at ../glib/gmain.c:3344
  g_main_context_dispatch_unlocked (context=0x55d93f77cde0) at ../glib/gmain.c:4152
  g_main_context_iterate_unlocked.isra.0 (context=0x55d93f77cde0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4217
  g_main_loop_run (loop=0x55d93f7589b0) at ../glib/gmain.c:4419
  main (argc=19, argv=0x7fff77359138) at src/nmcli/nmcli.c:1044

Fixes: f377114d6e ('cli: connection: check for deprecated features')

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1872
(cherry picked from commit 416d596b31)
(cherry picked from commit 9a42722718)
2024-03-14 09:03:21 +01:00
Beniamino Galvani
00525ff9be dhcp: remove l3cds when the lease expires
When the lease is lost, NM tries to get a new by restarting the DHCP
transaction. However, it doesn't delete the existing l3cds (one from
the DHCP client with flag ONLY_FOR_ACD, the other from
NMDevice). Therefore, the l3cfg still tracks the ACD state of the
address as "external-removed", and when NM gets the same address via
DHCP, ACD is considered as failed; as a consequence, NM sends a
DECLINE message to the server.

Moreover, the l3cd added by NMDevice for DHCP has a zero ACD timeout,
and so it's not possible to do ACD again on the same address.

Remove those l3cds when the lease expires, so that any ACD state is
cleared and DHCP can perform ACD again.

Fixes: 240ec7f891 ('dhcp: implement ACD (address collision detection) for DHCPv4')

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1853
(cherry picked from commit a80fef9f37)
(cherry picked from commit fe734c5c11)
2024-03-14 09:03:13 +01:00
Jan Vaclav
e3f5229930 libnm-core: fix mac comparison in _remove_mac_blacklist_item_by_value
The comparison checking for MAC address equality had previously been flipped around.

Fixes: b084ad7f2b ('libnm-core: canonicalize hardware addresses in settings')
(cherry picked from commit 641e717797)
(cherry picked from commit 08b1a08ef8)
2024-03-14 09:02:56 +01:00
Thomas Haller
318e1668bf glib-aux: fix atomic pattern in nm_ref_string_unref()
It's simply not valid to read the ref-count without an atomic.
The compiler might optimize out the assignment to "r" and read the
_ref_count field multiple times. Thereby, we might at first appear
to be larger than > 1, and later pass 1 to compare-and-exchange.

We need an atomic get here.

Fixes: 19d4027824 ('refstr: inline nm_ref_string_{ref,unref}()')

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1847
(cherry picked from commit 5f7a027f59)
(cherry picked from commit 0904bab5e2)
2024-03-14 09:02:43 +01:00
Íñigo Huguet
c8a34bcf7e core: Fix unextractable translation string
Glib format specifiers are not gettext friendly. It even emits a
warning: src/core/main-utils.c:196: warning: Although being used in a
format string position, the msgid is not a valid C format string."

One possible solution is to use the equivalent format specifiers from
<inttypes.h> like PRId64, available since C99.

Even simpler is to cast the value to a type that is big enough to hold
it according to C specs (i.e. for int64: long long).

Fixes: 50f34217f9 ('main: use _nm_utils_ascii_str_to_int64 instead of strtol for reading pid')
(cherry picked from commit c86f9e47fb)
2024-03-14 09:02:28 +01:00
Fernando Fernandez Mancera
e918871983 netns: schedule a commit when a single-hop route is merged
When a single-hop route is merged with another single-hop route from a
different interface creating a new ECMP route, NetworkManager needs to
schedule a commit on the l3cfg that is managing the first single-hop
route. Otherwise, the single-hop will continue to be there until a new
commit is scheduled.

Fixes: d9d33e2acc ('netns: fix configuring onlink routes for ECMP routes')
(cherry picked from commit 02efd96396)
2024-03-14 09:02:14 +01:00
Thomas Haller
a39b897759 core: fix nm_netns_ip_route_ecmp_commit() to return regular single-hop route
nm_netns_ip_route_ecmp_commit() returns the ECMP routes that didn't find
a merge-partner. It expects NML3Cfg to configure such routes in
platform.

Note that these routes have a positive "weight", which was used for
tracking the ECMP information in NML3Cfg and NMNetns.

But in kernel, single-hop routes don't have a weight. All routes in
NMPlatform will have a zero weight. While it somewhat works to call
nm_platform_ip_route_add() with a single-hop route of non-zero weight,
the result will be a different(!) route. This means for example that
nm_platform_ip_route_sync() will search the NMPlatform cache for whether
the routes exist, but in the cache single-hop routes with positive weight
never exist. Previously this happened and nm_platform_ip_route_sync()
would not delete those routes when it should.

It's also important because NML3Cfg tracks the object states of routes
that it wants to configure, vs routes in kernel (NMPlatform cache). The
route in kernel has a weight of zero. The route we want to configure
must also have a weight of zero.

The solution is that nm_netns_ip_route_ecmp_commit() does not tell
NML3Cfg to add a route, that cannot be added. Instead, it must first
normalize the weight to zero, to have a "regular" single-hop route.

Fixes: 5b5ce42682 ('nm-netns: track ECMP routes')
(cherry picked from commit 7a748ae556)
2024-03-14 09:02:03 +01:00
Thomas Haller
4600a811fb platform: fix handling "weight" for IPv4 routes
The hash/cmp functions were wrong with respect to IPv4 routes. Fix that.

- the weight was cast to a guint8, which is too small to hold all
  values.

- NM_PLATFORM_IP_ROUTE_CMP_TYPE_ID comparison would normalize a zero
  weight to one

    NM_CMP_DIRECT(NM_MAX(a->weight, 1u), NM_MAX(b->weight, 1u));

  That was very wrong.

- the handling of the weight depends on the n_nexthops parameter.
  See _ip4_route_weight_normalize().

The remarkable thing is that upper layers find it useful to track IPv4
single-hop routes with a non-zero weight. Consequently, this is honored
by NM_PLATFORM_IP_ROUTE_CMP_TYPE_ID to treat single-hop routes
different, when their weight differs. However, adding such a route in
kernel will not work. To kernel, single-hop routes have no weight. While
the route exists as distinct in our hash tables, according to the
implemented identity, it never exists in kernel (or NMPlatform cache).
Well, you can call nm_platform_ip_route_add() with such a route, but the
result will have a weight of zero (making it a different route). See also
nm_platform_ip_route_normalize().

This works all mostly fine. The only thing to take care is that you
cannot look into the NMPlatform cache and ever find a IPv4 single-hop
route with a non-zero weight. If you preform such a lookup, realize that
such routes don't exist in platform. You can however normalize the
weight to zero first (nm_platform_ip_route_normalize()) and look for a
similar route with a zero weight.

Fixes: 1bbdecf5e1 ('platform: manage ECMP routes')
(cherry picked from commit bc53ad4976)
2024-03-14 09:00:58 +01:00
Thomas Haller
550f6589d8 libnm: mark missing "FwMark" for NMDeviceIPTunnel as ignored
This was forgotten to implement. But we cannot just forget about it.
Libnm emits a warning about unknown properties, exactly to catch such
bugs. Properties that are not implemented, must be marked to be ignored.

Next, support for this property will be added. But that introduces new
API, which cannot be backported. Hence, first fix the problem by marking
the property as ignored. This is a backportable change.

  $ LIBNM_CLIENT_DEBUG="warning" G_DEBUG=fatal-warnings nmcli
  (process:270215): nm-WARNING **: 15:22:56.125: libnm-dbus: <warn > nmclient[8094a8c217aae461]: get-managed-objects: [/org/freedesktop/NetworkManager/Devices/5]: ignore unknown property org.freedesktop.NetworkManager.Device.IPTunnel.FwMark
  Trace/breakpoint trap (core dumped)

Fixes: 351c562491 ('devices: support VTI tunnels')
(cherry picked from commit b47c94666c)
2024-03-14 08:52:40 +01:00
Jan Vaclav
58d3326344 build/meson: fix gtkdoc dependencies
This commit fixes the build process for the documentation that was previously
unable to build separately via meson due to a dependency issue.

Previously, trying to build the API documentation via `ninja NetworkManager-doc`
failed due to missing dependencies (for example, `nm-dbus-types.xml` was not built).
I believe this happens due to some different handling of static paths vs. custom_target
by meson in this case.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1801
Fixes: 03637ad8b5 ('build: add initial support for meson build system')
(cherry picked from commit ffb34d2485)
2024-03-14 08:52:27 +01:00
Wen Liang
052627dd7c device: change port deactivation reason upon user-request controller deactivation
When connection down is explicitly called on the controller, the port
connection should also be deactivated with the reason user-requested,
otherwise any following connection update on the controller profile
will unblock the port connection and unnessarily make the port to
autoconnet again.

Fixes: 645a1bb0ef ('core: unblock autoconnect when master profile changes')
https://gitlab.freedesktop.org/NetworkManager/NetworkManager-ci/-/merge_requests/1568
(cherry picked from commit 21a6d7a0b6)
2024-03-14 08:52:17 +01:00
Beniamino Galvani
489129e3f2 device: fix indentation
Fixes: 50a6386c3b ('device: disable IPv6 in NetworkManager when disabled in kernel')
(cherry picked from commit e44909321c)
2024-03-14 08:51:59 +01:00
Beniamino Galvani
c227bf43fe l3cfg: fix handling of ipv6 hop limit
Fixes: 5c48c5d5d6 ('l3cfg: set IPv6 sysctls during NML3Cfg commit')

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1497

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1883
(cherry picked from commit b185d21c95)
(cherry picked from commit a2ca3515c8)
2024-03-14 08:42:28 +01:00
Gris Ge
c448e22519 bridge: skip VLAN filtering resetting in reapply if no vlan change changed
When doing reapply on linux bridge interface, NetworkManager will reset
the VLAN filtering and default PVID which cause PVID been readded to all
bridge ports regardless they are managed by NetworkManager.

This is because Linux kernel will re-add PVID to bridge port upon the
changes of bridge default-pvid value.

To fix the issue, this patch introduce netlink parsing code for
`vlan_filtering` and `default_pvid` of NMPlatformLnkBridge, and use that
to compare desired VLAN filtering settings, skip the reset of VLAN
filter if `default_pvid` and `vlan_filtering` are unchanged.

Signed-off-by: Gris Ge <fge@redhat.com>
(cherry picked from commit 02c34d538c)
(cherry picked from commit f990f9b4e4)
2024-02-21 10:31:30 +01:00
Yuki Inoguchi
4a9cf4c1dd device: disable IPv6 in NetworkManager when disabled in kernel
When IPv6 is disabled in kernel but ipv6.method is set to auto, NetworkManager repeatedly attempts
IPv6 configuration internally, resulting in unnecessary warning messages being output infinitely.

  platform-linux: do-add-ip6-address[2: fe80::5054:ff:fe7c:4293]: failure 95 (Operation not supported)
  ipv6ll[e898db403d9b5099,ifindex=2]: changed: no IPv6 link local address to retry after Duplicate Address Detection failures (back off)
  platform-linux: do-add-ip6-address[2: fe80::5054:ff:fe7c:4293]: failure 95 (Operation not supported)
  ipv6ll[e898db403d9b5099,ifindex=2]: changed: no IPv6 link local address to retry after Duplicate Address Detection failures (back off)
  platform-linux: do-add-ip6-address[2: fe80::5054:ff:fe7c:4293]: failure 95 (Operation not supported)
  ipv6ll[e898db403d9b5099,ifindex=2]: changed: no IPv6 link local address to retry after Duplicate Address Detection failures (back off)

To prevent this issue, let's disable IPv6 in NetworkManager when it is disabled in the kernel.

In order to do it in activate_stage3_ip_config() only once during activation,
the firewall initialization needed to be moved earlier. Otherwise, the IPv6 disablement could occur
twice during activation because activate_stage3_ip_config() is also executed from subsequent of fw_change_zone().

(cherry picked from commit 50a6386c3b)
2024-02-09 15:41:56 +01:00
Thomas Haller
92d2c0f7bc
clang-format: rework "nm-code-format-container.sh" script
Instead of doing the broken `podman run` and `podman start` approach,
build an image ("nm-code-format:f38"), cache it, and use it to run
"nm-code-format.sh" via `podman run`. We should build and keep a
container image, not a container.

The benefit is that this allows to hand over the command line arguments
to "nm-code-format.sh". In particular the "-u" and "-F" options, which
are life savers.

This means,

  $ contrib/scripts/nm-code-format-container.sh -u

works.

Try also

  $ contrib/scripts/nm-code-format-container.sh -h

which tells you that you are running inside the container, and how to
delete/renew the container image.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1798
(cherry picked from commit a6e085b3e8)
2023-11-22 13:28:54 +01:00
Thomas Haller
4ae41a8843
valgrind: add valgrind suppression for memmove() overlap
This valgrind error is raised by Ubuntu 23:10, with valgrind 1:3.21.0-0ubuntu1 and
glibc 2.38-1ubuntu6:

  ==141967== Source and destination overlap in memcpy_chk(0x1ffefffe98, 0x1ffefffe92, 8)
  ==141967==    at 0x4851042: __memcpy_chk (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
  ==141967==    by 0x502A9CC: memmove (string_fortified.h:36)
  ==141967==    by 0x502A9CC: inet_pton6 (inet_pton.c:226)
  ==141967==    by 0x502A9CC: __inet_pton_length (inet_pton.c:56)
  ==141967==    by 0x502A9CC: inet_pton (inet_pton.c:69)
  ==141967==    by 0x114FA3: nmtst_inet6_from_string_p (nm-test-utils.h:1764)
  ==141967==    by 0x114FA3: _nmtst_assert_ip6_address (nm-test-utils.h:1856)
  ==141967==    by 0x114FA3: test_stable_privacy (test-utils.c:26)
  ==141967==    by 0x4DEC85D: ??? (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7800.0)
  ==141967==    by 0x4DEC78A: ??? (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7800.0)
  ==141967==    by 0x4DECD2A: g_test_run_suite (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7800.0)
  ==141967==    by 0x4DECE07: g_test_run (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7800.0)
  ==141967==    by 0x4F070CF: (below main) (libc_start_call_main.h:58)
  ==141967==
  {
     <insert_a_suppression_name_here>
     Memcheck:Overlap
     fun:__memcpy_chk
     fun:memmove
     fun:inet_pton6
     fun:__inet_pton_length
     fun:inet_pton
     fun:nmtst_inet6_from_string_p
     fun:_nmtst_assert_ip6_address
     fun:test_stable_privacy
     obj:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7800.0
     obj:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7800.0
     fun:g_test_run_suite
     fun:g_test_run
     fun:(below main)
  }

This is because memmove() can call __memcpy_chk(), which triggers the
false positive in valgrind.

It probably affects other places too, but for us it's sufficient to
restrict the valgrind suppression to calls from inet_pton(). This
suppression will probably break with LTO enabled.

See-also: https://bugs.kde.org/show_bug.cgi?id=402833

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1802
(cherry picked from commit 9f1d4b650c)
2023-11-22 13:28:32 +01:00
Beniamino Galvani
8ed7cbd827 ovs: merge branch 'bg/ovs-netdev'
https://issues.redhat.com/browse/RHEL-5883
https://issues.redhat.com/browse/RHEL-5886
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1761

(cherry picked from commit 8122d99505)
2023-11-21 10:25:42 +01:00
Beniamino Galvani
fadabfddb9 ovs-interface: wait that the cloned MAC changes instead of setting it
If a ovs interface has the cloned-mac-address property set, we pass
the desired MAC to ovsdb when creating the db entry, and openvswitch
will eventually assign it to the interface.

Note that usually the link will not have the desired MAC when it's
created. Therefore, currently we also change the MAC via netlink
before proceeding with IP configuration. This is important to make
sure that ARP announcements, DHCP client-id, etc. will use the correct
MAC address.

This doesn't work when using the "netdev" (userspace) datapath, as the
attempts to change the MAC of the tun interface via netlink fail,
leading to an activation failure.

To properly handle both cases in the same way, adopt a different
strategy: now we don't set the MAC address explicitly via netlink but
we only wait until ovs does that.

(cherry picked from commit acf485196c)
2023-11-21 10:25:41 +01:00
Beniamino Galvani
9f01713824 ovs-interface: add check_waiting_for_link()
Add a helper function to check whether the ovs link is ready. In the
next commit, a new condition will be added to the helper.

(cherry picked from commit 3ad82e2726)
2023-11-21 10:25:41 +01:00
Beniamino Galvani
08ffcf2278 ovs-interface: fix state change in link_changed()
The function checks that priv->wait_link.waiting is set. Since the
flag is only set in stage3, it is wrong to schedule stage2 again.

(cherry picked from commit 01a6a2dc15)
2023-11-21 10:25:41 +01:00
Beniamino Galvani
ac0ae3eada ovs-interface: improve comments
(cherry picked from commit c7f1e3719f)
2023-11-21 10:25:41 +01:00