Commit graph

40 commits

Author SHA1 Message Date
Thomas Haller
5245fc6c75
platform: rename nmp_lookup_init_object() to nmp_lookup_init_object_by_ifindex()
In the past, nmp_lookup_init_object() could both lookup all object for a
certain ifindex, and lookup all objects of a type. That fallback path
already leads to an assertion failure fora while now, so nobody should
be using this function to lookup all objects of a certain type (for
what, we have nmp_lookup_init_obj_type()).

Now, remove the fallback path, and rename the function to what it really
does.
2022-06-30 14:08:41 +02:00
Beniamino Galvani
90e7afc2cd libnm,core: add support for {rto_min,quickack,advmss} route attributes 2022-06-27 11:38:43 +02:00
Thomas Haller
f4c7b5b7b7
all: avoid using systemd path utils 2022-04-20 12:07:03 +02:00
Thomas Haller
b8f689ac53
all: add support for route type "throw"
After adding support for "blackhole", "unreachable" and "prohibit" route
types, let's also add support for "throw" type. It works basically the
same as the other types, so supporting it seems very straight forward.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1124
2022-02-28 17:17:03 +01:00
Thomas Haller
2ebf9a0e89
core: increase NM_SHUTDOWN_TIMEOUT_MAX_MSEC to 5 sec to cover pppd
NM_SHUTDOWN_TIMEOUT_MAX_MSEC is the maximum timeout for how long any
async operation may take. The idea is that during shutdown of NetworkManager
we give that much time to tear down. Then async operations may either implement
cancellation or not bother with that. But in any case, they must complete within
NM_SHUTDOWN_TIMEOUT_MAX_MSEC.

Actually, for the time being, this has no effect at all. I am talking about the
future here. See "Improve Shutdown of NetworkManager" in TODO. This patch
is preparation for that effort.

Anyway. Stopping pppd can take a longer time (5 seconds). That is
currently the (known) longest time how long any of our async operations
is allowed to take.

As all async operations must complete before NM_SHUTDOWN_TIMEOUT_MAX_MSEC,
and we want to wait at least 5 seconds for pppd, we need to increase the
wait time NM_SHUTDOWN_TIMEOUT_MAX_MSEC.

Also add and use NM_SHUTDOWN_TIMEOUT_5000_MSEC, which serves a similar
purpose as NM_SHUTDOWN_TIMEOUT_1500_MSEC.
2022-02-24 09:38:53 +01:00
Thomas Haller
8bb85aecda
core: add NM_SHUTDOWN_TIMEOUT_1500_MSEC macro
When you have an async operation, you must make sure that
it is cancellable or completes in at most NM_SHUTDOWN_TIMEOUT_MAX_MSEC.

But NM_SHUTDOWN_TIMEOUT_MAX_MSEC leaves it undefined how long it is.
If you really want to wait for 1500msec, but also need to ensure
to stay within NM_SHUTDOWN_TIMEOUT_MAX_MSEC, then use
NM_SHUTDOWN_TIMEOUT_1500_MSEC. This has the semantic of guaranteeing
both.
2022-02-24 09:38:53 +01:00
Thomas Haller
32a828080c
core/trivial: rename NM_SHUTDOWN_TIMEOUT_MS to NM_SHUTDOWN_TIMEOUT_MAX_MSEC
The abbreviations "ms", "us", "ns" don't look good.
Spell out to "msec", "usec", "nsec" as done at other places.

Also, rename NM_SHUTDOWN_TIMEOUT_MS_WATCHDOG to
NM_SHUTDOWN_TIMEOUT_ADDITIONAL_MSEC.

Also, rename NM_SHUTDOWN_TIMEOUT_MS to NM_SHUTDOWN_TIMEOUT_MAX_MSEC.
There are different timeouts, and this is the maximum gracetime we
will give during shutdown to complete async operations.

Naming is hard, but I think these are better names.
2022-02-24 09:38:52 +01:00
Thomas Haller
6255e0dcac
core: handle blackhole/unreachable/prohibit route types in core
Specifically, in nm_utils_ip_route_attribute_to_platform() and in
_l3_config_data_add_obj() handle such new route type. For the moment,
they cannot be stored in a valid NMSettingIPConfig, but later this will
be necessary.
2022-02-09 19:13:05 +01:00
Thomas Haller
596d1645e8
core: use IS_IPv4 variable in nm_utils_ip_route_attribute_to_platform()
It's what we do at many other places. Consistency.
2022-02-09 19:13:03 +01:00
Thomas Haller
615221a99c format: reformat source tree with clang-format 13.0
We use clang-format for automatic formatting of our source files.
Since clang-format is actively maintained software, the actual
formatting depends on the used version of clang-format. That is
unfortunate and painful, but really unavoidable unless clang-format
would be strictly bug-compatible.

So the version that we must use is from the current Fedora release, which
is also tested by our gitlab-ci. Previously, we were using Fedora 34 with
clang-tools-extra-12.0.1-1.fc34.x86_64.

As Fedora 35 comes along, we need to update our formatting as Fedora 35
comes with version "13.0.0~rc1-1.fc35".
An alternative would be to freeze on version 12, but that has different
problems (like, it's cumbersome to rebuild clang 12 on Fedora 35 and it
would be cumbersome for our developers which are on Fedora 35 to use a
clang that they cannot easily install).

The (differently painful) solution is to reformat from time to time, as we
switch to a new Fedora (and thus clang) version.
Usually we would expect that such a reformatting brings minor changes.
But this time, the changes are huge. That is mentioned in the release
notes [1] as

  Makes PointerAligment: Right working with AlignConsecutiveDeclarations. (Fixes https://llvm.org/PR27353)

[1] https://releases.llvm.org/13.0.0/tools/clang/docs/ReleaseNotes.html#clang-format
2021-11-29 09:31:09 +00:00
Beniamino Galvani
96850933bb core: ignore external routes when generating connections 2021-11-18 16:21:32 +01:00
Thomas Haller
58287cbcc0 core: rework IP configuration in NetworkManager using layer 3 configuration
Completely rework IP configuration in the daemon. Use NML3Cfg as layer 3
manager for the IP configuration of an interface. Use NML3ConfigData as
pieces of configuration that the various components collect and
configure. NMDevice is managing most of the IP configuration at a higher
level, that is, it starts DHCP and other IP methods. Rework the state
handling there.

This is a huge rework of how NetworkManager daemon handles IP
configuration. Some fallout is to be expected.

It appears the patch deletes many lines of code. That is not accurate, because
you also have to count the files `src/core/nm-l3*`, which were unused previously.

Co-authored-by: Beniamino Galvani <bgalvani@redhat.com>
2021-11-18 16:21:29 +01:00
Beniamino Galvani
d50c4eba9e core: disable tc cache by default
We no longer use tc objects from the platform cache; disable caching
by default.

The only exception where the cache is needed is in tc tests, as we
look into the platform there to check that objects look as expected.
2021-09-20 13:27:16 +02:00
Beniamino Galvani
864e4e6369 platform: allow disabling caching of tc objects
Introduce a construct-only property for platform objects to enable or
disable the caching of tc objects. When disabled, the netlink socket
doesn't receive netlink events for tc objects, and objects are never
added to the cache. This commit doesn't change behavior yet.
2021-09-20 13:27:16 +02:00
Gris Ge
e69c5e4bab
libnm: Use _nm_connection_ensure_setting()
Use `_nm_connection_ensure_setting()` to eliminate the
duplicated codes. This function will retrieve the specific setting from
connection, if not found, create new one and attach to the connection.

Signed-off-by: Gris Ge <fge@redhat.com>
2021-08-20 19:02:23 +02:00
Thomas Haller
4c3aac899e
all: unify and rename strv helper API
Naming is important, because the name of a thing should give you a good
idea what it does. Also, to find a thing, it needs a good name in the
first place. But naming is also hard.

Historically, some strv helper API was named as nm_utils_strv_*(),
and some API had a leading underscore (as it is internal API).

This was all inconsistent. Do some renaming and try to unify things.

We get rid of the leading underscore if this is just a regular
(internal) helper. But not for example from _nm_strv_find_first(),
because that is the implementation of nm_strv_find_first().

  - _nm_utils_strv_cleanup()                 -> nm_strv_cleanup()
  - _nm_utils_strv_cleanup_const()           -> nm_strv_cleanup_const()
  - _nm_utils_strv_cmp_n()                   -> _nm_strv_cmp_n()
  - _nm_utils_strv_dup()                     -> _nm_strv_dup()
  - _nm_utils_strv_dup_packed()              -> _nm_strv_dup_packed()
  - _nm_utils_strv_find_first()              -> _nm_strv_find_first()
  - _nm_utils_strv_sort()                    -> _nm_strv_sort()
  - _nm_utils_strv_to_ptrarray()             -> nm_strv_to_ptrarray()
  - _nm_utils_strv_to_slist()                -> nm_strv_to_gslist()
  - nm_utils_strv_cmp_n()                    -> nm_strv_cmp_n()
  - nm_utils_strv_dup()                      -> nm_strv_dup()
  - nm_utils_strv_dup_packed()               -> nm_strv_dup_packed()
  - nm_utils_strv_dup_shallow_maybe_a()      -> nm_strv_dup_shallow_maybe_a()
  - nm_utils_strv_equal()                    -> nm_strv_equal()
  - nm_utils_strv_find_binary_search()       -> nm_strv_find_binary_search()
  - nm_utils_strv_find_first()               -> nm_strv_find_first()
  - nm_utils_strv_make_deep_copied()         -> nm_strv_make_deep_copied()
  - nm_utils_strv_make_deep_copied_n()       -> nm_strv_make_deep_copied_n()
  - nm_utils_strv_make_deep_copied_nonnull() -> nm_strv_make_deep_copied_nonnull()
  - nm_utils_strv_sort()                     -> nm_strv_sort()

Note that no names are swapped and none of the new names existed
previously. That means, all the new names are really new, which
simplifies to find errors due to this larger refactoring. E.g. if
you backport a patch from after this change to an old branch, you'll
get a compiler error and notice that something is missing.
2021-07-29 10:26:50 +02:00
Thomas Haller
3775f4395a
all: drop unnecessary casts from nm_utils_strv_find_first()
And, where the argument is a GPtrArray, use
nm_strv_ptrarray_find_first() instead.
2021-07-29 09:33:50 +02:00
Thomas Haller
f9b43ed7d4
core: add parameters options to nm_utils_complete_generic() 2021-07-08 17:20:15 +02:00
Thomas Haller
eb634c6077
core: don't override user provided "connection.interface-name" in nm_utils_complete_generic()
nm_utils_complete_generic() is supposed to complete information which the user
didn't provide. If the profile already has an interface-name, keep it.
2021-07-08 17:20:15 +02:00
Thomas Haller
b8ae2dfa70
core/trivial: add comment about GMainContext to nm_shutdown_wait_obj_register_full() 2021-06-15 18:15:56 +02:00
Thomas Haller
b1625697cb
firewall: move firewall code to new "nm-firewall-utils.c" file 2021-05-07 11:42:50 +02:00
Thomas Haller
ad37120065
firewall: rework iptables rules for shared mode to use custom chain
- add our own rules to a separate custom change. This allows
  to simply flush and delete the chain. This is supposed to
  interfere less with what is already configured on the system.

- also use comments to our rules, so that we can delete them
  more explicitly and don't kill the wrong rule.

- rework the code how we call iptables. We no longer create a list
  of argv arguments that we iterate over. Instead, call functions that
  do the job. The actual arguments move further down the call stack.

- enabling masquerading is now more separate from our other shared
  rules. These two things are mostly independent and the code now
  reflects that.

Before:
  up:   /usr/sbin/iptables --table filter --insert INPUT --in-interface eth0 --protocol tcp --destination-port 53 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert INPUT --in-interface eth0 --protocol udp --destination-port 53 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert INPUT --in-interface eth0 --protocol tcp --destination-port 67 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert INPUT --in-interface eth0 --protocol udp --destination-port 67 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert FORWARD --in-interface eth0 --jump REJECT
  up:   /usr/sbin/iptables --table filter --insert FORWARD --out-interface eth0 --jump REJECT
  up:   /usr/sbin/iptables --table filter --insert FORWARD --in-interface eth0 --out-interface eth0 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert FORWARD --source 192.168.42.0/255.255.255.0 --in-interface eth0 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --insert FORWARD --destination 192.168.42.0/255.255.255.0 --out-interface eth0 --match state --state ESTABLISHED,RELATED --jump ACCEPT
  up:   /usr/sbin/iptables --table nat --insert POSTROUTING --source 192.168.42.0/255.255.255.0 ! --destination 192.168.42.0/255.255.255.0 --jump MASQUERADE
  down: /usr/sbin/iptables --table nat --delete POSTROUTING --source 192.168.42.0/255.255.255.0 ! --destination 192.168.42.0/255.255.255.0 --jump MASQUERADE
  down: /usr/sbin/iptables --table filter --delete FORWARD --destination 192.168.42.0/255.255.255.0 --out-interface eth0 --match state --state ESTABLISHED,RELATED --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete FORWARD --source 192.168.42.0/255.255.255.0 --in-interface eth0 --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete FORWARD --in-interface eth0 --out-interface eth0 --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete FORWARD --out-interface eth0 --jump REJECT
  down: /usr/sbin/iptables --table filter --delete FORWARD --in-interface eth0 --jump REJECT
  down: /usr/sbin/iptables --table filter --delete INPUT --in-interface eth0 --protocol udp --destination-port 67 --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete INPUT --in-interface eth0 --protocol tcp --destination-port 67 --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete INPUT --in-interface eth0 --protocol udp --destination-port 53 --jump ACCEPT
  down: /usr/sbin/iptables --table filter --delete INPUT --in-interface eth0 --protocol tcp --destination-port 53 --jump ACCEPT

Now:

  up:   /usr/sbin/iptables --table nat --insert POSTROUTING --source 192.168.42.0/24 ! --destination 192.168.42.0/24 --jump MASQUERADE -m comment --comment nm-shared-eth0
  up:   /usr/sbin/iptables --table filter --new-chain nm-sh-in-eth0
  up:   /usr/sbin/iptables --table filter --append nm-sh-in-eth0 --protocol tcp --destination-port 67 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-in-eth0 --protocol udp --destination-port 67 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-in-eth0 --protocol tcp --destination-port 53 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-in-eth0 --protocol udp --destination-port 53 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --new-chain nm-sh-fw-eth0
  up:   /usr/sbin/iptables --table filter --append nm-sh-fw-eth0 --destination 192.168.42.0/24 --out-interface eth0 --match state --state ESTABLISHED,RELATED --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-fw-eth0 --source 192.168.42.0/24 --in-interface eth0 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-fw-eth0 --in-interface eth0 --out-interface eth0 --jump ACCEPT
  up:   /usr/sbin/iptables --table filter --append nm-sh-fw-eth0 --out-interface eth0 --jump REJECT
  up:   /usr/sbin/iptables --table filter --append nm-sh-fw-eth0 --in-interface eth0 --jump REJECT
  up:   /usr/sbin/iptables --table filter --insert INPUT --in-interface eth0 --jump nm-sh-in-eth0 -m comment --comment nm-shared-eth0
  up:   /usr/sbin/iptables --table filter --insert FORWARD --jump nm-sh-fw-eth0 -m comment --comment nm-shared-eth0
  down: /usr/sbin/iptables --table nat --delete POSTROUTING --source 192.168.42.0/24 ! --destination 192.168.42.0/24 --jump MASQUERADE -m comment --comment nm-shared-eth0
  down: /usr/sbin/iptables --table filter --delete INPUT --in-interface eth0 --jump nm-sh-in-eth0 -m comment --comment nm-shared-eth0
  down: /usr/sbin/iptables --table filter --delete FORWARD --jump nm-sh-fw-eth0 -m comment --comment nm-shared-eth0
  down: /usr/sbin/iptables --table filter --flush nm-sh-in-eth0
  down: /usr/sbin/iptables --table filter --delete-chain nm-sh-in-eth0
  down: /usr/sbin/iptables --table filter --flush nm-sh-fw-eth0
  down: /usr/sbin/iptables --table filter --delete-chain nm-sh-fw-eth0
2021-05-07 11:42:49 +02:00
Thomas Haller
c752de2237
firewall: extract _share_iptables_set_masquerade() helper
When we configure iptables rules, we really do two independent
steps: enable masquerading and do some filtering.

As such, introduce a helper method _share_iptables_set_masquerade() for
the masquerading part.

nm_utils_share_rules_apply() is at the moment a bit odd, because
of the order in which we add/remove the rule. This will get better next.
2021-05-07 11:42:37 +02:00
Thomas Haller
f5e12f3915
firewall: use prefix length instead of netmask for iptables arguments
The form "address/netmask" is unnecessarily verbose. iptables
supports prefix length notation just fine.
2021-05-07 11:42:37 +02:00
Thomas Haller
734c82d789
firewall: add _share_iptables_subnet_to_str() helper for creating string 2021-05-07 11:42:37 +02:00
Thomas Haller
27e325c6c2
firewall: extract helper function _shared_iptables_call() to spawn iptables 2021-05-07 11:42:36 +02:00
Thomas Haller
2277c9490a
firewall: rework NMUtilsShareRules to generate argv on demand
Previously, NMUtilsShareRules basically was tracking a list of command
line arguments, and during apply(), it would spawn the (iptables)
processes.

But in practice, this list was always pre-determined by a few
parameters, the interface name and the subnet. Instead of keeping the
list of arguments, only keep those few parameters. And generate the list
of arguments only for the short time when we need them.

The difference is that we will want to support nftables too. Later,
we can just generate a different list of commands, but there is no
need to keep this list around.
2021-05-07 11:42:36 +02:00
Thomas Haller
a9a33f2d12
firewall: downgrade info logging for iptables commands
Sure, it's interesting to see the actual iptables commands in the log.
But not at <info> level!
2021-05-07 11:42:36 +02:00
Thomas Haller
2fcabf5699
all: only include "libnm-glib-aux/nm-uuid.h" where needed
Don't let "nm-core-internal.h" (which is a very popular header itself)
drag in "nm-uuid.h".
2021-05-04 15:51:51 +02:00
Thomas Haller
73cfc4097a
libnm,glib-aux: add and use nm_uuid_generate_random_str*() helpers 2021-05-04 15:51:45 +02:00
Thomas Haller
80e30f4562
all: use nm_g_variant_new_au() helper 2021-04-16 11:44:20 +02:00
Thomas Haller
972d1ba046
libnm,core: support "uidrange" parameter for routing rules 2021-03-23 14:19:38 +01:00
Thomas Haller
945612cc5d
all: use nm_net_aux_rtnl_rtntype_{n2a,a2n}() helpers 2021-03-23 14:19:38 +01:00
Thomas Haller
604b1d0331
platform: move more platform code to src/libnm-platform/ 2021-03-05 11:27:16 +01:00
Thomas Haller
d3585243c3
core: move creating singleton instance out of "nm-platform.c"
In core, NMPlatform is (also) a singleton instance. As we will move platform code
to libnm-platform, this singleton part makes no sense there. Move the code
to NetworkManagerUtils.c.
2021-03-05 11:27:15 +01:00
Thomas Haller
9dc84b32b0
build: move "shared/nm-{glib-aux,log-null,log-core}" to "src/libnm-{glib-aux,log-null,log-core}" 2021-02-24 12:48:20 +01:00
Thomas Haller
39225258d6
build: move "shared/systemd" to "src/libnm-systemd-shared" 2021-02-24 12:48:16 +01:00
Thomas Haller
fdf9614ba7
build: move "libnm-core/" to "src/" and split it
"libnm-core/" is rather complicated. It provides a static library that
is linked into libnm.so and NetworkManager. It also contains public
headers (like "nm-setting.h") which are part of public libnm API.

Then we have helper libraries ("libnm-core/nm-libnm-core-*/") which
only rely on public API of libnm-core, but are themself static
libraries that can be used by anybody who uses libnm-core. And
"libnm-core/nm-libnm-core-intern" is used by libnm-core itself.

Move "libnm-core/" to "src/". But also split it in different
directories so that they have a clearer purpose.

The goal is to have a flat directory hierarchy. The "src/libnm-core*/"
directories correspond to the different modules (static libraries and set
of headers that we have). We have different kinds of such modules because
of how we combine various code together. The directory layout now reflects
this.
2021-02-18 19:46:51 +01:00
Thomas Haller
dc2afc9b77
all: add "src/core/nm-default-daemon.h" as replacement for "nm-default.h" 2021-02-09 12:38:18 +01:00
Thomas Haller
ac1a9e03e4
all: move "src/" directory to "src/core/"
Currently "src/" mostly contains the source code of the daemon.
I say mostly, because that is not true, there are also the device,
settings, wwan, ppp plugins, the initrd generator, the pppd and dhcp
helper, and probably more.

Also we have source code under libnm-core/, libnm/, clients/, and
shared/ directories. That is all confusing.

We should have one "src" directory, that contains subdirectories. Those
subdirectories should contain individual parts (libraries or
applications), that possibly have dependencies on other subdirectories.
There should be a flat hierarchy of directories under src/, which
contains individual modules.

As the name "src/" is already taken, that prevents any sensible
restructuring of the code.

As a first step, move "src/" to "src/core/". This gives space to
reorganize the code better by moving individual components into "src/".

For inspiration, look at systemd's "src/" directory.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/743
2021-02-04 09:45:55 +01:00
Renamed from src/NetworkManagerUtils.c (Browse further)