Commit graph

1956 commits

Author SHA1 Message Date
Jan Vaclav
cd3d492618 platform: configure HSR protocol version from property
Uses the `hsr.protocol-version` property defined in the previous
commit to configure the property in the kernel.

(cherry picked from commit 0b99629278)
2025-11-17 14:41:27 +01:00
Jan Vaclav
6f454c98a9 device: add support for reapplying the sriov.vfs property
Adds support for reapplying the `sriov.vfs` property. Note this
does not include `num_vfs`, as the configuration needs to be reset
and reconfigured from scratch in that case.

Previously, if an existing VF is modified (e.g. if we change the `trust`
flag), we reset all VF configurations, and started from scratch. But in
some cases, this is unnecessarily disruptive.

Resolves: https://issues.redhat.com/browse/RHEL-95844
(cherry picked from commit 4ba3ffee67)
2025-10-15 09:43:50 +02:00
Jan Vaclav
b2d8f60c49 device: extract sriov platform vf generation to separate function
(cherry picked from commit 588a69cd1b)
2025-10-15 09:43:49 +02:00
Íñigo Huguet
8326cc32d6 ovs: don't remove unrelated external ports
The commit linked below introduced a bug that caused that OVS ports
added externally to NM are always deleted when we delete any OVS
interface. It affects to all externally added ports, including those
that are not related to the deleted interface and even those in
different OVS bridges.

Fix it by only modifying ports and bridges that are ascendants of the
deleted interface, leaving everything else untouched.

Note that bridges and ports still need to have at least one NM-managed
interface, otherwise they will also be purged. For example, an NM-owned
OVS bridge with 2 ports+iface, one NM-owned and one external: if we
delete the NM-owned iface, both ports and the bridge will be deleted.
For now, this is a known limitation that is not being fixed here.

Fixes: 476c89b6f2 ('ovs: only keep bridges and ports with NM interfaces attached')
(cherry picked from commit 93491d76ec)
2025-10-15 08:59:04 +02:00
Íñigo Huguet
0c4647d507 wifi: don't recheck auto-activate on disposal
During disposal we're calling to remove_all_aps that in turns schedules
an auto-activate recheck. As the device is removed, this triggers an
assertion when trying to do the recheck.

Fix that by not scheduling the recheck.

Example of backtrace that this commits fix:
  0  __libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
  1  0xf746e270 in __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=<optimized out>) at pthread_kill.c:43
  2  0xf743fbc6 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
  3  0xf7431614 in __GI_abort () at abort.c:79
  4  0xf775afea in g_assertion_message (domain=domain@entry=0x209a9f "nm", file=file@entry=0x1f7d59 "../NetworkManager-1.43.7/src/core/nm-policy.c", line=line@entry=1665,
     func=func@entry=0x1f94d9 <__func__.6> "nm_policy_device_recheck_auto_activate_schedule",
     message=message@entry=0x1d3e950 "assertion failed: (g_signal_handler_find(device, G_SIGNAL_MATCH_DATA, 0, 0, NULL, NULL, NM_POLICY_GET_PRIVATE(self)) != 0)")
     at ../glib-2.72.3/glib/gtestutils.c:3253
  5  0xf775b05e in g_assertion_message_expr (domain=0x209a9f "nm", file=0x1f7d59 "../NetworkManager-1.43.7/src/core/nm-policy.c", line=1665,
     func=0x1f94d9 <__func__.6> "nm_policy_device_recheck_auto_activate_schedule",
     expr=0x1f8afc "g_signal_handler_find(device, G_SIGNAL_MATCH_DATA, 0, 0, NULL, NULL, NM_POLICY_GET_PRIVATE(self)) != 0") at ../glib-2.72.3/glib/gtestutils.c:3279
  6  0x0005f27a in nm_policy_device_recheck_auto_activate_schedule (self=0x1d3e950, device=0x209a9f) at ../NetworkManager-1.43.7/src/core/nm-policy.c:1679
  7  0x000548ae in nm_manager_device_recheck_auto_activate_schedule (self=<optimized out>, device=<optimized out>) at ../NetworkManager-1.43.7/src/core/nm-manager.c:3113
  8  0x00070622 in nm_device_recheck_auto_activate_schedule (self=<optimized out>) at ../NetworkManager-1.43.7/src/core/devices/nm-device.c:9249
  9  0xf693aa8c in ap_add_remove (self=self@entry=0x1ceb0b0, is_adding=0, ap=<optimized out>, recheck_available_connections=0)
     at ../NetworkManager-1.43.7/src/core/devices/wifi/nm-device-wifi.c:846
  10 0xf693bcda in remove_all_aps (self=self@entry=0x1ceb0b0) at ../NetworkManager-1.43.7/src/core/devices/wifi/nm-device-wifi.c:863
  11 0xf693f83c in dispose (object=0x1ceb0b0) at ../NetworkManager-1.43.7/src/core/devices/wifi/nm-device-wifi.c:3809
  12 0xf7806e72 in g_object_unref (_object=<optimized out>) at ../glib-2.72.3/gobject/gobject.c:3636
  13 g_object_unref (_object=0x1ceb0b0) at ../glib-2.72.3/gobject/gobject.c:3553
  14 0x000f7fa4 in _nm_dbus_object_clear_and_unexport (location=location@entry=0xffa50644) at ../NetworkManager-1.43.7/src/core/nm-dbus-object.c:203
  15 0x000576e4 in remove_device (self=self@entry=0x1c9c900, device=<optimized out>, quitting=quitting@entry=1) at ../NetworkManager-1.43.7/src/core/nm-manager.c:2289
  16 0x0005a864 in nm_manager_stop (self=self@entry=0x1c9c900) at ../NetworkManager-1.43.7/src/core/nm-manager.c:7784
  17 0x00023438 in main (argc=<optimized out>, argv=<optimized out>) at ../NetworkManager-1.43.7/src/core/main.c:530

Fixes: 96f40dcdcd ('wifi/ap: explicitly unexport AP and refactor add/remove AP')
Fixes: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1791
(cherry picked from commit 3904135150)
2025-09-12 13:21:45 +02:00
Íñigo Huguet
2de3de0c28 core: keep empty groups from keyfile configs
When reading NetworkManager.conf and NetworkManager-intern.conf we might
need to know if a group is defined or not, even if it's empty. This is
the case, for example, for [global-dns]. If [global-dns] is defined in
NM.conf overwrites the config from NM-intern, and if it's defined in any
of them they overwrite the configs from connections.

Before this patch, defining it as an empty group was ignored:
```
[global-dns]
```

Instead, it was necessary to add at least one key-value to the group.
Otherwise the group was silently ignored.
```
[global-dns]
searches=
```

Keep empty groups so we can take better decissions about overwritting
configs from other sources.

(cherry picked from commit 4a46f454da)
2025-09-12 13:20:14 +02:00
Íñigo Huguet
58e776c3a8 core: dns: show in D-Bus if [global-dns] is defined but empty
Clients like nmstate needs to know if the [global-dns] section is
defined or not, so they know if DNS configs from connections are
relevant or not. Expose it in D-Bus by always exposing "searches"
and "options" if it's defined, maybe as empty lists.

(cherry picked from commit 7fb4724efa)
2025-09-12 13:20:14 +02:00
Íñigo Huguet
f92a2bfd1f dns: make [global-dns] to overwrite configs from connections
According to the documentation, settings from [global-dns] (searches and
options) are always merged with those from connections. However this was
not happening if no [global-dns-domain-*] exists, in which case
connections were ignored. This happened because in the past both global
sections must de defined or undefined. When this was changed to allow
defining only [global-dns], allowing it in the function that generates
the resolv.conf file was forgotten. Fix that now.

Anyway, merging these configs doesn't make much sense. The searches and
options defined in connections probably make sense only for the nameservers
defined in that same connection.

Because of this, make the following change: if global nameservers are
defined, use searches and options from [global-dns] only, because those
defined in connections may not make sense for the global nameservers. If
[global-dns] is missing, assume an empty [global-dns] section.

Also, if no global nameservers are defined, but [global-dns] is, make
that it overwrites the searches and options defined in connections. This
is not ideal, but none of the alternatives is better and at least this
is easy to remember.

So, the resulting rules from above are:
- If [global-dns] is defined, it always overwrite searches and options
  from connections.
- If [global-dns-domain-*] is defined, it always overwrite nameservers
  from connections. It overwrites searches and options too.

Fixes: 1f0d1d78d2 ('dns-manager: always apply options from [global-dns]')
Fixes: f57a848da5 ('man: update documentation about global DNS configuration')
(cherry picked from commit 1cba0a3cca)
2025-09-12 13:20:13 +02:00
Íñigo Huguet
48eae2e76d core: dbus: accept global DNS configuration without a default domain
Since 1.44 we accept a global-dns section without any global-dns-domain
section, so users can define searches and options without defining any
global DNS servers.

When set from the D-Bus API it was still rejected. Fix it.

Fixes: 1f0d1d78d2 ('dns-manager: always apply options from [global-dns]')
(cherry picked from commit 294131a2a4)
2025-09-12 13:20:13 +02:00
Pradyumn Rahar
ec93c9d282 bond: remove lacp_active option from reapply subset
NM_SETTING_BOND_OPTION_LACP_ACTIVE is flagged as BOND_OPTFLAG_IFDOWN in
the kernel and hence should not be in OPTIONS_REAPPLY_SUBSET.

Authored-by: Mohith Kumar Thummaluru <mohith.k.kumar.thummaluru@oracle.com>
Signed-off-by: Mohith Kumar Thummaluru <mohith.k.kumar.thummaluru@oracle.com>
Signed-off-by: Pradyumn Rahar <pradyumn.rahar@oracle.com>
(cherry picked from commit 9c48bae3b2)
2025-09-12 13:19:31 +02:00
Beniamino Galvani
de46cf1ee9 manager: unrealize device again after failure
If the device was realized in _internal_activate_device() and the
activation failed to start, unrealize the device again so that it
doesn't stay around.

Fixes-test: @ovs_delete_connecting_interface

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2263
(cherry picked from commit 7242c478a1)
2025-09-12 13:17:01 +02:00
Beniamino Galvani
7e1c72fa63 device: explicitly handle unrealized devices in is_available()
Unrealized software devices are always available for activation,
hardware devices never.

In nm_manager_get_best_device_for_activation() we call
nm_device_is_available() on candidate devices. Without this fix, any
unrealized software device would be not considered ready for
activation, which is wrong.

A software device can override the default implementation of
is_available(). For example NMDeviceOvsInterface does that and only
checks the OVSDB is ready.

Fixes: ba86c208e0 ('Revert "core: prevent the activation of unavailable OVS interfaces only"')

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2253
(cherry picked from commit 8b26cb35ee)
2025-09-12 13:15:18 +02:00
Beniamino Galvani
1f23bb18ad device: ensure that sw devices are unrealized after connection deletion
When a software device becomes deactivated, we check whether it can
be unrealized (= deleted in kernel), by calling function
delete_on_deactivate_check_and_schedule().

The function returns without doing anything if there is a new
activation enqueued on the device (priv->queued_act_request), because
in that case the device will be reused for the next activation.

This commit fixes a problem seen in NMCI test
@ovs_delete_connecting_interface: sometimes the device is not
unrealized after deleting the connection. That happens because if the
queued activation fails, we never try again to unrealize the device.

Fix that by calling delete_on_deactivate_check_and_schedule() when
there is a failure starting the queued activation.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2258
(cherry picked from commit 0b03614b68)
2025-08-27 13:12:47 +02:00
Beniamino Galvani
a386912ddb platform: fix compilation without LTO
Fix the following error seen when running the build_clean.sh script
with LTO disabled:

  In file included from ../src/libnm-glib-aux/nm-default-glib.h:66,
                   from ../src/libnm-glib-aux/nm-default-glib-i18n-prog.h:13,
                   from ../src/core/nm-default-daemon.h:11,
                   from ../src/core/platform/tests/test-link.c:6:
  In function ‘_nm_auto_freev’,
      inlined from ‘test_link_get_bridge_fdb’ at ../src/core/platform/tests/test-link.c:2732:33:
  ../src/libnm-glib-aux/nm-macros-internal.h:166:8: error: ‘addrs’ may be used uninitialized [-Werror=maybe-uninitialized]
    166 |     if (*p) {
        |        ^
  ../src/core/platform/tests/test-link.c: In function ‘test_link_get_bridge_fdb’:
  ../src/core/platform/tests/test-link.c:2732:33: note: ‘addrs’ was declared here
   2732 |     nm_auto_freev NMEtherAddr **addrs;
        |                                 ^~~~~
  cc1: all warnings being treated as errors

Fixes: 16ef33d380 ('bond-slb: fix memory leak')
(cherry picked from commit b4a22ad2a9)
2025-07-31 15:59:35 +02:00
Beniamino Galvani
43058de07a device: fix signal emission on port detach/release
The "notify::controller" signal must be emitted on the port, not on
the controller.

Fixes: 1f05526ed7 ('core: drop NMDevice master and introduce controller')
(cherry picked from commit 012f1cbfac)
2025-07-31 15:59:32 +02:00
Beniamino Galvani
ca7d42cd7a l3cfg: don't reset the ACD probe timestamp during timer events
acd_data->probing_timestamp_msec indicates when the probing
started. It is used in different places to calculate the timeout for
certain operations. In particular, it is used to detect that the probe
creation took too long when handling the ACD_STATE_CHANGE_MODE_TIMEOUT
event.

If we reset this timestamp at every timer event, we'll never hit the
probe creation timeout. Therefore, the l3cfg will keep trying forever
to create the probe.
See: https://lists.freedesktop.org/archives/networkmanager/2025-July/000418.html

Fix this by not updating the timestamp during a timeout event.

Fixes: a09f9cc616 ('l3cfg: ensure the probing timeout is initialized on probe start')
(cherry picked from commit 407d753a5a)
2025-07-31 15:59:32 +02:00
Beniamino Galvani
2e963061cb l3cfg: fix logging message
Fix spacing in:

 acd[192.168.122.42, probing]: probing currently  stillnot possible
                                                 ^^^^^^^^^

Fixes: b8f9d7b5dd
(cherry picked from commit 74cf2a2bd8)
2025-07-31 15:59:31 +02:00
Beniamino Galvani
8ae10b4148 ndisc: fix logic to limit the number of addresses
Fixes: c2c8c67d8c ('ndisc: rate limit number of accepted RA data to track')
(cherry picked from commit eb7917a387)
2025-07-31 15:59:31 +02:00
Beniamino Galvani
e56bc740d0 core: fix nm_utils_get_nm_gid()
Fixes: 31dbcb81fe ('core: make nm_utils_get_nm_[ug]id() thread safe')
(cherry picked from commit b58a37acfe)
2025-07-31 15:59:30 +02:00
Beniamino Galvani
12e033368f core: fix Wi-Fi data rate tables
Fixes: f2b0092b5b ('wifi: parse BSS IEs for 80211n and 80211ac data rates')
(cherry picked from commit fa80896ee7)
2025-07-31 15:59:30 +02:00
Beniamino Galvani
f4c5ded09b dhcp: fix parsing of the search list option
The DHCP search list option (119) can use the "message compression"
algorithm specified in RFC 1035 section 4.1.4 to reduce the size of
the message in presence of subdomains that appear multiple times.

When using the compression a label starts with:

    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    | 1  1|                OFFSET                   |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

where the offset points to a previous domain.

Previously, the parsing code was taking the lower 6 bits of the first
byte, shifting them left 16 bits, and adding the next byte. Instead,
the shift should be of 8 bits.

The effect of this bug was that when the offset was greater than 255,
it was incorrectly parsed as a number larger than the message size,
and the parsing failed.

Note that while a single DHCP option can be at most 255 bytes, a DHCP
message can contain multiple instances of the same option. The
receiver must concatenate all the occurrences according to RFC 3396
and parse the resulting buffer.

Fixes: 6adade6f21 ('dhcp: add nettools dhcp4 client')
(cherry picked from commit a9d7abbc50)
2025-07-31 15:59:29 +02:00
Beniamino Galvani
ce40c72812 dhcp: fix typo in tcp_keepalive_interval option name
Fixes: eed205bff3 ('dhcp/internal: move dhcp options management to shared dhcp codebase')
(cherry picked from commit d017dc67b4)
2025-07-31 15:59:29 +02:00
Beniamino Galvani
85edac5d7c bond-slb: fix memory leak
If sendto() fails, the function returns and the remaining entries are
not deallocated. Use nm_auto_freev instead to free the array and the
pointer it contains.

Add a test to check that nm_auto_freev does the right thing on the
value returned by nm_linux_platform_get_bridge_fdb().

Fixes: 3f2f922dd9 ('bonding: send ARP announcement on bonding-slb link/carrier down')
(cherry picked from commit 16ef33d380)
2025-07-31 15:59:29 +02:00
Beniamino Galvani
a909c6f611 platform: rename nm_linux_platform_get_link_fdb_table()
Rename nm_linux_platform_get_link_fdb_table() to
nm_linux_platform_get_bridge_fdb(). The new name better indicates that
the function returns the bridge FDB entries.

(cherry picked from commit 7d23ed9f73)
2025-07-31 15:59:24 +02:00
Beniamino Galvani
9cddd7c0a4 vrf: fix wrong logging domain
Fixes: 667568d1b2 ('core,libnm: add VRF support')
(cherry picked from commit 20a1d7e816)
2025-07-31 15:42:31 +02:00
Beniamino Galvani
051c2f8ea1 lldp: fix memchr() argument order
The validation of embedded NUL character was skipped due to the wrong
order of arguments to memchr(). Fix it.

Fixes: 4043f82790 ('lldp: cleanup converting binary LLDP fields to string')
(cherry picked from commit ce17284c3f)
2025-07-31 15:42:31 +02:00
Beniamino Galvani
d34d564bb4 supplicant: fix wrong check on "EAP" signal arguments
The check is inverted.

Fixes: b83f07916a ('supplicant: large rework of wpa_supplicant handling')
(cherry picked from commit 50a400e16f)
2025-07-31 15:42:31 +02:00
Beniamino Galvani
cbe5da4fd4 libnm-core,core: accept uid/gid up to (2^32 - 2) for tun devices
Linux UIDs/GIDs are 32-bit unsigned integer, with 4294967295 reserved
as undefined.

Before:
  # useradd -u 4294967294 -M testuser
  useradd warning: testuser's uid -2 outside of the UID_MIN 1000 and UID_MAX 60000 range.
  # nmcli connection add type tun ifname tun1 owner 4294967294 ipv4.method disabled ipv6.method disabled
  Error: Failed to add 'tun-tun1' connection: tun.owner: '4294967294': invalid user ID

After:
  # useradd -u 4294967294 -M testuser
  useradd warning: testuser's uid -2 outside of the UID_MIN 1000 and UID_MAX 60000 range.
  # nmcli connection add type tun ifname tun1 owner 4294967294 ipv4.method disabled ipv6.method disabled
  Connection 'tun-tun1' (5da24d19-1723-45d5-8e04-c976f7a251d0) successfully added.
  # ip -d link show tun1
  2421: tun1: <NO-CARRIER,POINTOPOINT,MULTICAST,NOARP,UP> mtu 1500 qdisc fq_codel state DOWN mode DEFAULT group default qlen 500
      link/none  promiscuity 0 allmulti 0 minmtu 68 maxmtu 65535
      tun type tun pi off vnet_hdr off persist on user testuser ...
                                                 ^^^^^^^^^^^^^
Fixes: 1f30147a7a ('libnm-core: add NMSettingTun')
(cherry picked from commit 253800238e)
2025-07-31 15:42:30 +02:00
Beniamino Galvani
a509efdbab ovs: fix logging message
Fixes: a259303e1d ('ovs: add support for "other_config" settings')
(cherry picked from commit 55765d2914)
2025-07-31 15:42:30 +02:00
Beniamino Galvani
2478dca1a1 core: fix properties update for HSR devices
Fixes: 5426bdf4a1 ('HSR: add support to HSR/PRP interface')
(cherry picked from commit 404a3ec853)
2025-07-31 15:42:30 +02:00
Beniamino Galvani
60e7bb86b8 bond: fix attribute assignment macro
Currently the bug is hidden because the macro is only called with
NM_SETTING_BOND_OPTION_ARP_IP_TARGET.

Fixes: 45c95e9314 ('device/bond: rework setting of arp_ip_target bond options')
(cherry picked from commit 1229fe5abd)
2025-07-31 15:42:30 +02:00
Beniamino Galvani
4deee49763 core: accept hostnames longer than 64 characters from DNS lookup
When resolving the system hostname from DNS lookup, we use
nm_utils_validate_hostname() which checks that the result is a valid
hostname. A valid hostname is at most 64 characters on Linux. Anything
longer is discarded.

However, the reverse DNS lookup doesn't return a hostname, it returns
a DNS name. The DNS name can have multiple labels, each limited to 63
characters. The maximum length of the DNS name is 253 characters.

If the result is longer than 64 characters because it has multiple
labels, we should still accept it, provided that it is a valid DNS
name. Then when setting the hostname in the system, only the first
label will be kept.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2243

Resolves: https://issues.redhat.com/browse/RHEL-104357
(cherry picked from commit b019883a9a)
2025-07-23 11:16:45 +02:00
Beniamino Galvani
c647c060d6 device: accept changes to the bond-port.vlans during reapply
Commit c5d1e35f99 ('device: support reapplying bridge-port VLANs')
didn't update can_reapply_change() to accept the "bridge-port.vlans"
property during a reapply. So, it was only possible to change the
bridge port VLANs by updating the "bridge.vlan-default-pvid" property
and doing a reapply. Fix that.

Fixes: c5d1e35f99 ('device: support reapplying bridge-port VLANs')
(cherry picked from commit 261fa8db33)
2025-07-23 11:03:10 +02:00
Beniamino Galvani
956f9ba365 bridge: fix reapplying port VLANs
If the bridge default-pvid is zero, it means that the default PVID is
disabled. That is, the bridge PVID is not propagated to ports.

Currently NM tries to merge the existing bridge VLANs on the port with
the default PVID from the bridge, even when the PVID is zero. This
causes an error when setting the new VLAN list in the kernel, because
it rejects VLAN zero.

Skip the merge of the default PVID when zero.

Fixes: c5d1e35f99 ('device: support reapplying bridge-port VLANs')
(cherry picked from commit bf79fbd678)
2025-07-23 11:03:10 +02:00
Lubomir Rintel
d16a62da2b device: don't disable IPv6 in stage3 on reapply
Currently, when a call to Reapply() results in stage3 being re-run, IPv6
ends up messed up. Like this:

  $ nmcli device modify eth0 ipv4.address ''
  $ nmcli device modify eth0 ipv4.address 172.31.13.37/24
  $

  NetworkManager[666]: <debug> [1751286095.2070] device[c95ca04a69467d81] (eth0): ip4: reapply...
  ...
  NetworkManager[666]: <debug> [1751286095.2104] device[c95ca04a69467d81] (eth0): ip6: addrgenmode6: set none (already set)
  NetworkManager[666]: <debug> [1751286095.2105] device[c95ca04a69467d81] (eth0): ip6: addrgenmode6: toggle disable_ipv6 sysctl after disabling addr-gen-mode
  NetworkManager[666]: <debug> [1751286095.2105] platform-linux: sysctl: setting '/proc/sys/net/ipv6/conf/eth0/disable_ipv6' to '1' (current value is '0')
  NetworkManager[666]: <debug> [1751286095.2106] platform-linux: sysctl: setting '/proc/sys/net/ipv6/conf/eth0/disable_ipv6' to '0' (current value is '1')
  NetworkManager[666]: <debug> [1751286095.2106] platform-linux: sysctl: setting '/proc/sys/net/ipv6/conf/eth0/accept_ra' to '0' (current value is identical)
  NetworkManager[666]: <debug> [1751286095.2106] platform-linux: sysctl: setting '/proc/sys/net/ipv6/conf/eth0/disable_ipv6' to '0' (current value is identical)

Not only is this unnecessary because addr-gen-mode already has the
desired value (as is logged), but also wipes off all IPv6 configuration.
This is fine on initial configuration, but not on Reapply().

Let's look at the device state first: if we've progressed past ip-config
state, then we can't possibly ever touch the offending sysctls. It's
okay -- we don't need to: addr-gen-mode is going to be set right if we
went through ip-config before.

Resolves: https://issues.redhat.com/browse/NMT-1681

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2232
(cherry picked from commit 9bbb113987)
2025-07-10 16:01:06 +02:00
Beniamino Galvani
7c03b3050e manager: add a capability for "sriov.preserve-on-down"
Add a new capability to indicate that NetworkManager supports the
"sriov.preserve-on-down" connection property. With this, clients can
set the property only when supported, without the risk of creating an
invalid connection.

(cherry picked from commit 8e40f7e289)
2025-07-01 09:38:17 +02:00
Wen Liang
4a727bfae0 core: expose the version info capability of IPv4 forwarding support
This commit adds NM_VERSION_INFO_CAPABILITY_IPV4_FORWARDING to the
VersionInfo D-Bus property, allowing clients such as nmstate to check
the NetworkManager's support of configuring per-device IPv4 sysctl
forwarding setting directly via the capabilities bitmask instead of
relying on the NetworkManager version comparisons.

(cherry picked from commit 6a13e8d369)
2025-06-30 21:25:33 +02:00
Beniamino Galvani
ddfc2696e3 device: allow reapplying the sriov.preserve-on-down property
It is useful when there is an already active device and we want to
bring it down preserving the SR-IOV VFs. For example:

  $ nmcli connection add type ethernet ifname eni1np1 sriov.total-vfs 2 ipv4.method disabled ipv6.method disabled
  $ nmcli connection up ethernet-eni1np1

  $ ip link show eni1np1
  342: eni1np1: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
      link/ether 6e:cf:f0:08:74:f4 brd ff:ff:ff:ff:ff:ff
      vf 0     link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, ...
      vf 1     link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, ...

  $ nmcli device modify eni1np1 sriov.preserve-on-down yes
  $ nmcli connection down ethernet-eni1np1

  $ ip link show eni1np1
  342: eni1np1: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
      link/ether 6e:cf:f0:08:74:f4 brd ff:ff:ff:ff:ff:ff
      vf 0     link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, ...
      vf 1     link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, ...

(cherry picked from commit 6f219aa649)
2025-06-20 14:41:34 +02:00
Beniamino Galvani
c88d75ac6a core: use the sriov.preserve-on-down property
(cherry picked from commit c70b4a98a3)
2025-06-20 14:41:33 +02:00
Beniamino Galvani
dd0ca122e3 ovs: set the tun interface up before stage3
When using the netdev datapath, we wait that the tun link appears, we
call nm_device_set_ip_ifindex() (which also brings the link up) and
then we check that the link is ready, i.e. that udev has announced the
link and the MAC address is correct. After that, we schedule stage3
(ip-config).

In this, there is a race condition that occurs sometimes in NMCI test
ovs_datapath_type_netdev_with_cloned_mac. In rare conditions,
nm_device_set_ip_ifindex() bring the interface up but then ovs-vswitch
changes again the flags of the interface without IFF_UP. The result is
that the interface stays down, breaking communications.

To fix this, we need to always call nm_device_bring_up() after the tun
device is ready. The problem is that we can't do it in
_netdev_tun_link_cb() because that function is already invoked
synchronously from platform code.

Instead, simplify the handling of the netdev datapath. Every
"link-changed" event from platform is handled by
_netdev_tun_link_cb(), which always schedule a delayed function
_netdev_tun_link_cb_in_idle(). This function just assigns the
ip-ifindex to the device if missing, and starts stage3 if the link is
ready. While doing so, it also bring the interface up.

Fixes: 99a6c6eda6 ('ovs, dpdk: fix creating ovs-interface when the ovs-bridge is netdev')

https://issues.redhat.com/browse/RHEL-17358

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2218
(cherry picked from commit 46e0d2b4e4)
2025-06-19 15:12:42 +02:00
Beniamino Galvani
c1d94d7081 connectivity: fix compiler warning when building without concheck
Fix the following:

../src/core/nm-connectivity.c:958:1: warning: ‘check_platform_config’ defined but not used [-Wunused-function]
  958 | check_platform_config(NMConnectivity *self,
      | ^~~~~~~~~~~~~~~~~~~~~

Fixes: 91d447df19 ('device: don't start connectivity check on unconfigured devices')

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2224
(cherry picked from commit 1253cbad5a)
2025-06-19 15:12:30 +02:00
Íñigo Huguet
1c1f31fdd4 ipv4: remove the forwarding=ignore value
It is not clear whether we can actually respect this value. For example,
we should not restore the kernel's default value on deactivation or
device's state change, but it is unclear if we can ensure that we'll
still have the connection's configuration in all possible changes of
state.

Also, it is unclear if it's a desirable value that we want to support.
At this point it is mostly clear that trying to configure NM managed
devices externally always ends being dissapointing, no matter how hard
we try.

Remove this value for now, while we discuss whether it makes sense or
not, so it doesn't become stable in the new 1.54 release.

(cherry picked from commit 82692cc75c)
2025-06-19 14:28:36 +02:00
Lubomir Rintel
dcf4bc9241 ovs/factory: fix manager-initiated device creation
The Open VSwitch interfaces have corresponding platform links. When an
Open VSwitch interface is created while NetworkManager is running, the
OVS factory usually sees an OVSDB entry appear first, then creates a
NMDevice. After that, when a platform link appears, the device is
already there.

Upon a (re-)start, the link might be seen first, and then things
go south. The OVS factory rejects the device, which results in Generic
device being created instead. Another device, this time of an
appropriate is created for the same link once the OVSDB entry is seen.

Needless to say, with two NMDevices for the same platform link existing,
no end of mayhem ensues (an assertion is tripped).

Resolves: https://issues.redhat.com/browse/NMT-1634

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2207
2025-05-27 11:29:01 +02:00
Lubomir Rintel
f680f23cba manager: note if we see an openvswitch link without a plugin
Add Open VSwitch to link types that are supported by a plugin.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2207
2025-05-27 11:29:01 +02:00
Lubomir Rintel
5ef3cfa4d0 ovs/factory: improve logging
Be clearer about the progress of creating the device and ways it can end
up failing.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2207
2025-05-27 11:29:01 +02:00
Tomas Korbar
75b3f8496b dns: Fix port handling in Dnsconfd plugin
Fixes #1765
2025-05-27 08:24:22 +00:00
Lubomir Rintel
ccd9431e82 device: update L3 if connectivity changes in IP_CHECK/SECONDARIES
If connectivity goes from/to FULL, the penalization of default route metric
may change. For this reason we re-commit L3 configuration if the
connectivity changes while the device is ACTIVATED.

However, there are more device states that need consideration:
IP_CHECK and SECONDARIES, that happen between initial configuration on
IP_CONFIG and removal when the device goes DEACTIVATING.

This should fix the issue encountered here:
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2070

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2212
2025-05-22 11:18:36 +02:00
Beniamino Galvani
c1350f40bd ip-config: fix crash in DNS options evaluation
Fixes: 58287cbcc0 ('core: rework IP configuration in NetworkManager using layer 3 configuration')
2025-05-16 09:41:03 +02:00
Beniamino Galvani
fd3eccfb16 device: update the external-down unmanaged flag on port attach/release
A device has the "external-down" unmanaged flag when:

  !is-created-by-nm AND (!is-up OR (!has-address AND !is-controller))

When the "is-up" or the "has-address" conditions change, we properly update
the unmanaged flag by calling _dev_unmanaged_check_external_down() in
_dev_l3_cfg_notify_cb(PLATFORM_CHANGE_ON_IDLE).

The "is-controller" condition changes when another link indicates the
current device as controller. We currently don't update the unmanaged flag
when that happens and so it's possible that the device stays unmanaged even
if it has a port. This can be easily reproduced by running this commands:

    ip link add veth0 type veth peer name veth1
    ip link add vrf0 type vrf table 10
    ip link set vrf0 up
    ip link set veth0 master vrf0

Sometimes, the device shows as "unmanaged" instead of "connected
(externally)".

Fix this by re-evaluating the "external-down" unmanaged flags on the
controller when a port is attached or detached.

Fixes: c3586ce01a ('device: consider a device with slaves configured')

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2209
2025-05-15 17:22:39 +02:00
Íñigo Huguet
94595332c4 core: virtual devices can be available without a parent set
When calling to nm_device_is_available, the device types that requires a
parent like VLAN or MACVLAN checks that their parent exists.

nm_device_is_available is a function to check if the device is available
to activate a connection, so it makes sense that if the parent is not
present it can't be activated.

However, this is wrong for 2 reasons:
1. Most of they are virtual devices that might be unrealized when
   checking its availability. If they're unrealized, their parent hasn't
   been set yet.
2. Even if they're realized, their current parent might not be the one
   that is defined in the connection that is being activated.

This is causing that unrealized devices are not being activated as ports
because nm_manager_get_best_device_for_connection thinks that they are
not available.

Get rid of these checks for the parent in the is_available callbacks.

Fixes: ba86c208e0 ('Revert "core: prevent the activation of unavailable OVS interfaces only"')
Fixes: 774badb151 ('core: prevent the activation of unavailable devices')
2025-05-14 05:42:19 +00:00