Commit graph

23 commits

Author SHA1 Message Date
Thomas Haller
f9b43ed7d4
core: add parameters options to nm_utils_complete_generic() 2021-07-08 17:20:15 +02:00
Thomas Haller
eb634c6077
core: don't override user provided "connection.interface-name" in nm_utils_complete_generic()
nm_utils_complete_generic() is supposed to complete information which the user
didn't provide. If the profile already has an interface-name, keep it.
2021-07-08 17:20:15 +02:00
Thomas Haller
b8ae2dfa70
core/trivial: add comment about GMainContext to nm_shutdown_wait_obj_register_full() 2021-06-15 18:15:56 +02:00
Thomas Haller
b1625697cb
firewall: move firewall code to new "nm-firewall-utils.c" file 2021-05-07 11:42:50 +02:00
Thomas Haller
ad37120065
firewall: rework iptables rules for shared mode to use custom chain
- add our own rules to a separate custom change. This allows
  to simply flush and delete the chain. This is supposed to
  interfere less with what is already configured on the system.

- also use comments to our rules, so that we can delete them
  more explicitly and don't kill the wrong rule.

- rework the code how we call iptables. We no longer create a list
  of argv arguments that we iterate over. Instead, call functions that
  do the job. The actual arguments move further down the call stack.

- enabling masquerading is now more separate from our other shared
  rules. These two things are mostly independent and the code now
  reflects that.

Before:
  up:   /usr/sbin/iptables --table filter --insert INPUT --in-interface eth0 --protocol tcp --destination-port 53 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert INPUT --in-interface eth0 --protocol udp --destination-port 53 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert INPUT --in-interface eth0 --protocol tcp --destination-port 67 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert INPUT --in-interface eth0 --protocol udp --destination-port 67 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert FORWARD --in-interface eth0 --jump REJECT
  up:   /usr/sbin/iptables --table filter --insert FORWARD --out-interface eth0 --jump REJECT
  up:   /usr/sbin/iptables --table filter --insert FORWARD --in-interface eth0 --out-interface eth0 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert FORWARD --source 192.168.42.0/255.255.255.0 --in-interface eth0 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert FORWARD --destination 192.168.42.0/255.255.255.0 --out-interface eth0 --match state --state ESTABLISHED,RELATED --jump ACCEPT
  up:   /usr/sbin/iptables --table nat --insert POSTROUTING --source 192.168.42.0/255.255.255.0 ! --destination 192.168.42.0/255.255.255.0 --jump MASQUERADE
  down: /usr/sbin/iptables --table nat --delete POSTROUTING --source 192.168.42.0/255.255.255.0 ! --destination 192.168.42.0/255.255.255.0 --jump MASQUERADE
  down: /usr/sbin/iptables --table filter --delete FORWARD --destination 192.168.42.0/255.255.255.0 --out-interface eth0 --match state --state ESTABLISHED,RELATED --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete FORWARD --source 192.168.42.0/255.255.255.0 --in-interface eth0 --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete FORWARD --in-interface eth0 --out-interface eth0 --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete FORWARD --out-interface eth0 --jump REJECT
  down: /usr/sbin/iptables --table filter --delete FORWARD --in-interface eth0 --jump REJECT
  down: /usr/sbin/iptables --table filter --delete INPUT --in-interface eth0 --protocol udp --destination-port 67 --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete INPUT --in-interface eth0 --protocol tcp --destination-port 67 --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete INPUT --in-interface eth0 --protocol udp --destination-port 53 --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete INPUT --in-interface eth0 --protocol tcp --destination-port 53 --jump ACCEPT

Now:

  up:   /usr/sbin/iptables --table nat --insert POSTROUTING --source 192.168.42.0/24 ! --destination 192.168.42.0/24 --jump MASQUERADE -m comment --comment nm-shared-eth0
  up:   /usr/sbin/iptables --table filter --new-chain nm-sh-in-eth0
  up:   /usr/sbin/iptables --table filter --append nm-sh-in-eth0 --protocol tcp --destination-port 67 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-in-eth0 --protocol udp --destination-port 67 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-in-eth0 --protocol tcp --destination-port 53 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-in-eth0 --protocol udp --destination-port 53 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --new-chain nm-sh-fw-eth0
  up:   /usr/sbin/iptables --table filter --append nm-sh-fw-eth0 --destination 192.168.42.0/24 --out-interface eth0 --match state --state ESTABLISHED,RELATED --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-fw-eth0 --source 192.168.42.0/24 --in-interface eth0 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-fw-eth0 --in-interface eth0 --out-interface eth0 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-fw-eth0 --out-interface eth0 --jump REJECT
  up:   /usr/sbin/iptables --table filter --append nm-sh-fw-eth0 --in-interface eth0 --jump REJECT
  up:   /usr/sbin/iptables --table filter --insert INPUT --in-interface eth0 --jump nm-sh-in-eth0 -m comment --comment nm-shared-eth0
  up:   /usr/sbin/iptables --table filter --insert FORWARD --jump nm-sh-fw-eth0 -m comment --comment nm-shared-eth0
  down: /usr/sbin/iptables --table nat --delete POSTROUTING --source 192.168.42.0/24 ! --destination 192.168.42.0/24 --jump MASQUERADE -m comment --comment nm-shared-eth0
  down: /usr/sbin/iptables --table filter --delete INPUT --in-interface eth0 --jump nm-sh-in-eth0 -m comment --comment nm-shared-eth0
  down: /usr/sbin/iptables --table filter --delete FORWARD --jump nm-sh-fw-eth0 -m comment --comment nm-shared-eth0
  down: /usr/sbin/iptables --table filter --flush nm-sh-in-eth0
  down: /usr/sbin/iptables --table filter --delete-chain nm-sh-in-eth0
  down: /usr/sbin/iptables --table filter --flush nm-sh-fw-eth0
  down: /usr/sbin/iptables --table filter --delete-chain nm-sh-fw-eth0
2021-05-07 11:42:49 +02:00
Thomas Haller
c752de2237
firewall: extract _share_iptables_set_masquerade() helper
When we configure iptables rules, we really do two independent
steps: enable masquerading and do some filtering.

As such, introduce a helper method _share_iptables_set_masquerade() for
the masquerading part.

nm_utils_share_rules_apply() is at the moment a bit odd, because
of the order in which we add/remove the rule. This will get better next.
2021-05-07 11:42:37 +02:00
Thomas Haller
f5e12f3915
firewall: use prefix length instead of netmask for iptables arguments
The form "address/netmask" is unnecessarily verbose. iptables
supports prefix length notation just fine.
2021-05-07 11:42:37 +02:00
Thomas Haller
734c82d789
firewall: add _share_iptables_subnet_to_str() helper for creating string 2021-05-07 11:42:37 +02:00
Thomas Haller
27e325c6c2
firewall: extract helper function _shared_iptables_call() to spawn iptables 2021-05-07 11:42:36 +02:00
Thomas Haller
2277c9490a
firewall: rework NMUtilsShareRules to generate argv on demand
Previously, NMUtilsShareRules basically was tracking a list of command
line arguments, and during apply(), it would spawn the (iptables)
processes.

But in practice, this list was always pre-determined by a few
parameters, the interface name and the subnet. Instead of keeping the
list of arguments, only keep those few parameters. And generate the list
of arguments only for the short time when we need them.

The difference is that we will want to support nftables too. Later,
we can just generate a different list of commands, but there is no
need to keep this list around.
2021-05-07 11:42:36 +02:00
Thomas Haller
a9a33f2d12
firewall: downgrade info logging for iptables commands
Sure, it's interesting to see the actual iptables commands in the log.
But not at <info> level!
2021-05-07 11:42:36 +02:00
Thomas Haller
2fcabf5699
all: only include "libnm-glib-aux/nm-uuid.h" where needed
Don't let "nm-core-internal.h" (which is a very popular header itself)
drag in "nm-uuid.h".
2021-05-04 15:51:51 +02:00
Thomas Haller
73cfc4097a
libnm,glib-aux: add and use nm_uuid_generate_random_str*() helpers 2021-05-04 15:51:45 +02:00
Thomas Haller
80e30f4562
all: use nm_g_variant_new_au() helper 2021-04-16 11:44:20 +02:00
Thomas Haller
972d1ba046
libnm,core: support "uidrange" parameter for routing rules 2021-03-23 14:19:38 +01:00
Thomas Haller
945612cc5d
all: use nm_net_aux_rtnl_rtntype_{n2a,a2n}() helpers 2021-03-23 14:19:38 +01:00
Thomas Haller
604b1d0331
platform: move more platform code to src/libnm-platform/ 2021-03-05 11:27:16 +01:00
Thomas Haller
d3585243c3
core: move creating singleton instance out of "nm-platform.c"
In core, NMPlatform is (also) a singleton instance. As we will move platform code
to libnm-platform, this singleton part makes no sense there. Move the code
to NetworkManagerUtils.c.
2021-03-05 11:27:15 +01:00
Thomas Haller
9dc84b32b0
build: move "shared/nm-{glib-aux,log-null,log-core}" to "src/libnm-{glib-aux,log-null,log-core}" 2021-02-24 12:48:20 +01:00
Thomas Haller
39225258d6
build: move "shared/systemd" to "src/libnm-systemd-shared" 2021-02-24 12:48:16 +01:00
Thomas Haller
fdf9614ba7
build: move "libnm-core/" to "src/" and split it
"libnm-core/" is rather complicated. It provides a static library that
is linked into libnm.so and NetworkManager. It also contains public
headers (like "nm-setting.h") which are part of public libnm API.

Then we have helper libraries ("libnm-core/nm-libnm-core-*/") which
only rely on public API of libnm-core, but are themself static
libraries that can be used by anybody who uses libnm-core. And
"libnm-core/nm-libnm-core-intern" is used by libnm-core itself.

Move "libnm-core/" to "src/". But also split it in different
directories so that they have a clearer purpose.

The goal is to have a flat directory hierarchy. The "src/libnm-core*/"
directories correspond to the different modules (static libraries and set
of headers that we have). We have different kinds of such modules because
of how we combine various code together. The directory layout now reflects
this.
2021-02-18 19:46:51 +01:00
Thomas Haller
dc2afc9b77
all: add "src/core/nm-default-daemon.h" as replacement for "nm-default.h" 2021-02-09 12:38:18 +01:00
Thomas Haller
ac1a9e03e4
all: move "src/" directory to "src/core/"
Currently "src/" mostly contains the source code of the daemon.
I say mostly, because that is not true, there are also the device,
settings, wwan, ppp plugins, the initrd generator, the pppd and dhcp
helper, and probably more.

Also we have source code under libnm-core/, libnm/, clients/, and
shared/ directories. That is all confusing.

We should have one "src" directory, that contains subdirectories. Those
subdirectories should contain individual parts (libraries or
applications), that possibly have dependencies on other subdirectories.
There should be a flat hierarchy of directories under src/, which
contains individual modules.

As the name "src/" is already taken, that prevents any sensible
restructuring of the code.

As a first step, move "src/" to "src/core/". This gives space to
reorganize the code better by moving individual components into "src/".

For inspiration, look at systemd's "src/" directory.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/743
2021-02-04 09:45:55 +01:00
Renamed from src/NetworkManagerUtils.c (Browse further)