Commit graph

2216 commits

Author SHA1 Message Date
Thomas Haller
574f2744dc ovs/trivial: fix indentation 2018-02-09 22:07:28 +01:00
Thomas Haller
6473b0868c wifi/iwd: make NMIwdManager:dispose() reentrant
Theoretically, dispose() could be called multiple times.
2018-02-09 21:34:20 +01:00
Andrew Zaborowski
3a30ea9fc6 iwd: avoid duplicate nm_device_iwd_set_dbus_object call
Avoid calling nm_device_iwd_set_dbus_object (device, NULL) if the
dbus_object was NULL already.  Apparently gdbus guarantees that a
name-owner notification either has a NULL old owner or a NULL new owner
but can also have both old and new owner NULL.
2018-02-09 21:30:46 +01:00
Andrew Zaborowski
86dd400049 iwd: recreate GDbusObjectManagerClient on reconnect
Reuse the apparent workaround from libnm/nm-client.c in which the
GDbusObjectManagerClient is recreated every time the name owner
pops up, instead of creating it once and using that object forever.
Resubscribe to all the signals on the new object.  The initial
GDbusObjectManager we create is only used to listed for the name-owner
changes.

There's nothing in gdbus docs that justifies doing that but there
doesn't seem to be any way to reliably receive all the signals from
the dbus service the normal way.  The signals do appear on dbus-monitor
and the gdbus apparently subscribes to those signals with AddMatch()
correctly but they sometimes won't be received by the client code,
unless this workaround is applied.

While making changes to got_object_manager, don't destroy the
cancellable there as it is supposed to be used throughout the
NMIwdManager life.
2018-02-09 21:30:46 +01:00
Andrew Zaborowski
d32987fdd1 iwd: keep reference to NMManager, disconnect signals
Disconnect from NMManager signals in our cleanup, make sure the
NMManager singleton is not destroyed before we are by keeping a
reference until we've disconnected from its signals.
2018-02-09 21:30:46 +01:00
Andrew Zaborowski
eea06b8a8c iwd: initialize priv->can_connect when DBus interface appears
Call state_changed with the initial Device.State property value to make
sure can_connect and can_scan are up to date.
2018-02-09 21:30:46 +01:00
Andrew Zaborowski
755d4e55c2 iwd: simple periodic scanning
Add very simple periodic scanning because IWD itself only does periodic
scanning when it is in charge of autoconnecting (by policy).  Since we
keep IWD out of the autoconnect state in order to use NM's autoconnect
logic, we need to request the scanning.  The policy in this patch is to
use a simple 10s period between the end of one scan the requesting of
another while not connected, and 20s when connected.  This is so that
users can expect similar results from both wifi backends but without
duplicating the more elaborate code in the wpa_supplicant backend which
can potentially be moved to a common superclass.
2018-02-09 21:30:46 +01:00
Thomas Haller
3e9e51f1dd core: distinguish between IFA_F_SECONDARY and IFA_F_TEMPORARY
While the numerical values of IFA_F_SECONDARY and IFA_F_TEMPORARY
are identical, their meaning is not.

IFA_F_SECONDARY is only relevant for IPv4 addresses, while
IFA_F_TEMPORARY is only relevant for IPv6 addresses.

IFA_F_TEMPORARY is automatically set by kernel for the addresses
that it generates as part of IFA_F_MANAGETEMPADDR. It cannot be
actively set by user-space.

IFA_F_SECONDARY is automatically set by kernel depending on the order
in which the addresses for the same subnet are added.

This essentially reverts 8b4f11927 (core: avoid IFA_F_TEMPORARY alias for
IFA_F_SECONDARY).
2018-02-09 21:07:57 +01:00
Thomas Haller
6d8a636563 device: fix IPv6 DAD to re-check whether address really failed DAD
In device_ipx_changed() we remember the addresses for which it appears
that DAD failed. Later, on an idle handler, we process them during
queued_ip6_config_change().

Note that nm_plaform_ip6_address_sync() might very well decide to remove
some or all addresses and re-add them immidiately later. It might do so,
to get the address priority/ordering right. At that point, we already
emit platform signals that the device disappeared, and track them in
dad6_failed_addrs.

Hence, later during queued_ip6_config_change() we must check again
whether the address is really not there and not still doing DAD.
Otherwise, we wrongly claim that DAD failed and remove the address,
generate a new one, and the same issue might happen again.
2018-02-09 17:40:01 +01:00
Thomas Haller
fc7448b310 device: don't check addr-source for addresses that failed IPv6 DAD
dad6_failed_addrs is populated with addresses from the platform cache.
Inside the cache, all addresses have addr_source NM_IP_CONFIG_SOURCE_KERNEL,
because addr_source property for addresses is only a property that is
used NetworkManager internally.
2018-02-09 17:40:01 +01:00
Thomas Haller
7ddd83e823 device: ignore temporary addresses for IPv6 DAD
Temporary addresses are entirely managed by kernel, via the mngtempaddr flag of the
primay address. No need to consider them for DAD.
2018-02-09 17:40:01 +01:00
Thomas Haller
95c94ff026 device: don't clone NMPlatformIP6Address for dad6_failed_addrs
NMPObjects are never modified after being put into the cache.
Hence, it is safe and encouraged to just keep a reference to them,
instead of cloning them.

Interestingly, NMPlatform's change signals have a platform_object
pointer, which is not the pointer to the NMPObjects itself, but
down-cast to the NMPlatformObject instance. It does so, because commonly
callers want to have a pointer to the NMPlatformObject instance, instead
of the outer NMPObjects. However, NMP_OBJECT_UP_CAST() is guaranteed
to work one would expect.
2018-02-09 17:40:01 +01:00
Thomas Haller
339d68dd8e device: use g_slist_prepend() to track dad6_failed_addrs
The order in which we add addresses to dad6_failed_addrs does not
matter. Hence, use g_slist_prepend() which is O(1), instead
g_slist_append() with O(n).
2018-02-09 17:40:01 +01:00
Thomas Haller
7459548f23 core: return remaining lifetime from nm_utils_lifetime_get()
nm_utils_lifetime_get() already has so many arguments.
Essentially, the function returned %TRUE if and only if the
lifetime was greater then zero.

Combine the return value and the output argument for the lifetime.

It also matches better the function name: to get the lifetime.
2018-02-09 17:40:01 +01:00
Thomas Haller
5c4f4b3540 ndisc: ensure proper lifetime of NMNDiscAddress in ndisc_set_router_config()
In ndisc_set_router_config(), we initialize NMNDiscAddress based on
NMPlatformIP6Address instances. Note that their handling of timestamps
is not entirely identical.

For convenience of the user, NMPlatformIP6Address allows to not specify
any timestamp. On the contrary, for convenience of implementation does
NMNDiscAddress always require fully specified timestamps.

Properly convert one representation into the other.
2018-02-09 17:40:01 +01:00
Thomas Haller
cd6cf0ea36 device: add const specifier to nm_ndisc_dad_failed() argument 2018-02-08 17:47:53 +01:00
Thomas Haller
e4839accf5 all: replace non-leading tabs with spaces
We commonly only allow tabs at the beginning of a line, not
afterwards. The reason for this style is so that the code
looks formated right with tabstop=4 and tabstop=8.
2018-02-07 13:32:04 +01:00
Thomas Haller
bbaa603a72 device: gracefully handle unmanaged device during _device_activate() 2018-02-07 12:35:22 +01:00
Thomas Haller
9c094f93fb device: don't return value from _device_activate()
It was only used at one place for an assertion. And it's not clear that the
assertion always holds.
2018-02-07 12:35:22 +01:00
Thomas Haller
ecf3677e57 device: clear priv->queued_act_request before setting state
Setting the state of NMActiveConnection results in invoking callbacks
in NMManager. Hence, it might be far-reaching. Clear
priv->queued_act_request before invoking the callbacks.
2018-02-07 12:35:22 +01:00
Thomas Haller
edc4dd5167 device: minor cleanup unqueuing queued_act_request
Use gs_unref_object and g_steal_pointer() to move ownership around.
2018-02-07 12:35:22 +01:00
Thomas Haller
6d623825f6 core: transit to DISCONNECTING state for NMActiveConnection
Don't just directly switch to DISCONNECTED state. If we are ACTIVATING
or ACTIVATED, first transition to DISCONNECTING state.
2018-02-07 12:35:22 +01:00
Thomas Haller
782578122c ovs: fix compiler error for passing NMDevice pointer to NM_DEVICE_OVS_INTERFACE_GET_PRIVATE()
NM_DEVICE_OVS_INTERFACE_GET_PRIVATE() is implemented via the _NM_GET_PRIVATE()
macro. This macro uses C11's _Generic() to provide additional compiler checks
when casting from an incompatible pointer type.

As such,

  NMDevice *device = ...;
  NMDeviceOvsInterfacePrivate *priv;

  priv = NM_DEVICE_OVS_INTERFACE_GET_PRIVATE (device);

causes a compilation error:

    error: ‘_Generic’ selector of type ‘NMDevice * {aka struct _NMDevice *}’ is not compatible with any association

One workaround would be to cast the pointer first:

  priv = NM_DEVICE_OVS_INTERFACE_GET_PRIVATE ((NMDeviceOvsInterface *) device);

A better fix is to mark NMDevice as a compatible pointer in _NM_GET_PRIVATE(),
which this patch does.

Previously, this went unnoticed, because due to bug "a43bf3388 build: fix configure
check for CC support of _Generic() and __auto_type", we failed to detect support
for _Generic() when compiling with -Werror. That essentially disables this check,
and NM_DEVICE_OVS_INTERFACE_GET_PRIVATE() would do a direct cast.

A workaround for this build failure might be to build with -Werror, which accidentally
results in not using _Generic().

https://bugzilla.gnome.org/show_bug.cgi?id=793183

Fixes: 8ad310f8e3
2018-02-05 13:59:15 +01:00
Lubomir Rintel
8ad310f8e3 ovs-interface: avoid starting ip[46] configuration more than once
OvsInterface can postpone the stage3_ip[46]_config until the link
actually appears. It ought to restart the stage only when the link
appears, not upon further changes to it (which would trip an assertion
when starting the DHCP client while one already exists).

https://bugzilla.redhat.com/show_bug.cgi?id=1540063
2018-02-05 10:57:16 +01:00
Thomas Haller
c93827e404 wifi/iwd: fix compiler warning about uninitialized variable with cleanup attribute
Must always initialize cleanup variable, to be able to build with
"-fexceptions".

    make[2]: Entering directory './contrib/fedora/rpm/NetworkManager.20180124-060444.C5tHCi/BUILD/NetworkManager-1.11.1'
      CC       src/devices/wifi/src_devices_wifi_libnm_device_plugin_wifi_la-nm-device-iwd.lo
    In file included from ./shared/nm-utils/nm-glib.h:27:0,
                     from ./shared/nm-utils/nm-macros-internal.h:60,
                     from ./shared/nm-default.h:257,
                     from src/devices/wifi/nm-device-iwd.c:21:
    src/devices/wifi/nm-device-iwd.c: In function ‘deactivate_async_finish’:
    ./shared/nm-utils/gsystem-local-alloc.h:37:8: error: ‘variant’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
         if (*(Type*)v) \
            ^
    src/devices/wifi/nm-device-iwd.c:405:29: note: ‘variant’ was declared here
      gs_unref_variant GVariant *variant;
                                 ^~~~~~~

Fixes: d0c1e1a62a
2018-01-24 06:14:34 +01:00
Thomas Haller
aed6e28461 trivial: avoid XXX tag and replace by NOTE or FIXME
XXX was used to either raise attention (NOTE) or to indicate
that this is ugly code that should be fixed (FIXME). The usage
was inconsistent.

Let's avoid XXX and use either NOTE or FIXME.
2018-01-23 12:55:33 +01:00
Andrew Zaborowski
c95c27a099 iwd: Wait for disconnect to finish
In a previous patch I added deactivate_async to make sure that NM
auto re-connect waits for the IWD state to changed from "disconnecting"
to "disconnected" before starting a new activation when the user wants
to switch from one profile to another.  This doesn't account for when
IWD itself goes into "disconnecting" because of a connect failure.

When IWD goes into the "disconnecting" state we call
  nm_device_state_changed (NM_DEVICE_STATE_FAILED,
                           NM_DEVICE_STATE_REASON_SUPPLICANT_DISCONNECT)
immediately to give feedback to user as soon as possible.  We will
return FALSE from get_autoconnect_allowed for the period the
"disconnecting" state.
2018-01-22 15:43:30 +01:00
Andrew Zaborowski
bcf3b10284 iwd: Initialize priv->scanning when DBus interface appears 2018-01-22 14:53:20 +01:00
Andrew Zaborowski
e6689154ae iwd: use connection.auth-retries to handle authentication retries
Repeat commit 72756994d4 for NMDeviceIwd.
2018-01-22 14:53:20 +01:00
Andrew Zaborowski
d0c1e1a62a iwd: Implement deactivate_async
Deactivating the connection translates to a Device.Disconnect dbus call
to IWD.  The dbus call normally returns immediately because the
corresponding nl80211 command returns immediately but we can't rely on
that.  Make sure that NMDevice waits for the IWD method return before
continuing with the new activation request when switching wifi networks.
2018-01-22 14:53:20 +01:00
Andrew Zaborowski
a4f9d117d5 iwd: Improve Device.State property change handling
The handler would until now check if nm_device_is_activating() was true
or the NMDevice state was "activated" to decide whether to report to
NMDevice that we'd been unexpectedly disconnected (i.e. connection
failed).  However NM's "prepare" and "need auth" states correspond to
IWD's "disconnected" state because they don't involve Wifi
authentication/association.

Additionally nm_device_is_activating() returns TRUE even when NMDevice
state is "disconnected" but an activation request is pending.  As a
result when switching networks, NMDevice would first save the activation
request and go into the "disconnected" state, we'd then call the IWD's
Disconnect method and when we received the IWD state change notification
to "disconnected", we'd cause the pending activation request to be
considered a failure.  The handler shouldn't report a failed
connection when the NMDevice state is "disconnected".
2018-01-22 14:53:20 +01:00
Beniamino Galvani
a0cf466482 wifi: enable WPA-*-SHA256 AKMs only when the supplicant supports them
Commit 87ec5e90fe ("supplicant: set key_mgmt independent of pmf
value") enabled WPA-PSK-SHA256 or WPA-EAP-SHA256 even when the
supplicant didn't support them, potentially causing connection
failures.  Instead, use the 'pmf' capability to detect when they can
be enabled.

Fixes: 87ec5e90fe

https://mail.gnome.org/archives/networkmanager-list/2018-January/msg00096.html
2018-01-22 08:38:28 +01:00
Beniamino Galvani
22f32a16f5 device: skip IP configuration phase for external devices
We already avoid committing the IP configuration for external devices
(see commit 60334a2893). However, we still start DHCP/IPv6-autoconf
and, especially, we change sysctl values of the device.

To be sure that no action is taken on the device, return early from
the IP configuration phase, as in the method=disabled/ignore case.

https://bugzilla.redhat.com/show_bug.cgi?id=1530288
2018-01-19 14:10:01 +01:00
Beniamino Galvani
156344b8be device: increase carrier wait time to 6 seconds
Some NICs need longer to establish the link, increase the timeout from
5 to 6 seconds.

https://bugzilla.redhat.com/show_bug.cgi?id=1520826
2018-01-18 15:26:34 +01:00
Lubomir Rintel
8a46b25cfa all: require glib 2.40
RHEL 7.1 and Ubuntu 14.04 LTS both have this.

https://bugzilla.gnome.org/show_bug.cgi?id=792323
2018-01-18 11:45:36 +01:00
Masashi Honma
0109615c4e supplicant: enable FILS only when wpa_supplicant supports it
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2018-01-16 15:01:59 +01:00
Masashi Honma
b4bbe5179f wifi: add support for FILS
The FILS(Fast Initial Link Setup) is a specification defined by IEEE 802.11ai to
speed up roaming. This patch adds support of it.

I have tested with these cases.
+-----+-------------------------+----------------+
| STA |            AP           |                |
|FILS |         key-mgmt        |     result     |
+-----+-------------------------+----------------+
|  1  | WPA-EAP                 |       O        |
+-----+-------------------------+----------------+
|  1  | WPA-EAP-SHA256          |       O        |
+-----+-------------------------+----------------+
|  1  | FILS-SHA256             |       X        |
+-----+-------------------------+----------------+
|  1  | FILS-SHA384             |       X        |
+-----+-------------------------+----------------+
|  1  | WPA-EAP WPA-EAP-SHA256  |       O        |
|     | FILS-SHA256 FILS-SHA384 | WPA-EAP-SHA256 |
+-----+-------------------------+----------------+
|  2  | WPA-EAP                 |       O        |
+-----+-------------------------+----------------+
|  2  | WPA-EAP-SHA256          |       O        |
+-----+-------------------------+----------------+
|  2  | FILS-SHA256             |       O        |
+-----+-------------------------+----------------+
|  2  | FILS-SHA384             |       O        |
+-----+-------------------------+----------------+
|  2  | WPA-EAP WPA-EAP-SHA256  |       O        |
|     | FILS-SHA256 FILS-SHA384 | FILS-SHA384    |
+-----+-------------------------+----------------+
|  3  | WPA-EAP                 |       X        |
+-----+-------------------------+----------------+
|  3  | WPA-EAP-SHA256          |       X        |
+-----+-------------------------+----------------+
|  3  | FILS-SHA256             |       O        |
+-----+-------------------------+----------------+
|  3  | FILS-SHA384             |       O        |
+-----+-------------------------+----------------+
|  3  | WPA-EAP WPA-EAP-SHA256  |       O        |
|     | FILS-SHA256 FILS-SHA384 | FILS-SHA384    |
+-----+-------------------------+----------------+

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2018-01-16 15:01:59 +01:00
Thomas Haller
aa9b8049ed core/trivial: fix whitespace 2018-01-12 14:50:53 +01:00
Thomas Haller
34cb6f9877 build/meson: use variables for ldflags and linker-script 2018-01-11 12:46:01 +01:00
Beniamino Galvani
41ef5853e6 ppp/trivial: rename field 2018-01-10 15:36:29 +01:00
Beniamino Galvani
dd98ada33f ppp: introduce SetIfindex pppd plugin D-Bus method
If IPV6CP terminates before IPCP, pppd enters the RUNNING phase and we
start IP configuration without having an IP interface set, which
triggers assertions.

Instead, add a SetIfindex() D-Bus method that gets called by the
plugin when pppd becomes RUNNING. The method sets the IP ifindex of
the device and starts IP configuration.

https://bugzilla.redhat.com/show_bug.cgi?id=1515829
2018-01-10 15:36:29 +01:00
Beniamino Galvani
2507046fea device: add nm_device_set_ip_ifindex() 2018-01-10 15:36:29 +01:00
Thomas Haller
349861ceec build/meson: unconditionally use linker version scripts
We also unconditionally use them with autotools.
Also, the detection for have_version_script does
not seem correct to me. At least, it didn't work
with clang.
2018-01-10 12:31:44 +01:00
Iñigo Martínez
5e16bcf268 meson: Improve dependency system
Some targets are missing dependencies on some generated sources in
the meson port. These makes the build to fail due to missing source
files on a highly parallelized build.

These dependencies have been resolved by taking advantage of meson's
internal dependencies which can be used to pass source files,
include directories, libraries and compiler flags.

One of such internal dependencies called `core_dep` was already in
use. However, in order to avoid any confusion with another new
internal dependency called `nm_core_dep`, which is used to include
directories and source files from the `libnm-core` directory, the
`core_dep` dependency has been renamed to `nm_dep`.

These changes have allowed minimizing the build details which are
inherited by using those dependencies. The parallelized build has
also been improved.
2018-01-10 12:20:17 +01:00
Pavel Šimerda
681d2bcd70 device: split per-directory factory function
In some cases we might want to load device plugins from multiple
directories. A special case that I have in mind is to load plugins from
build directory subdirectories in order to run NetworkManager from the
build directory.

[thaller@redhat.com: modify original patch]
2018-01-10 11:01:46 +01:00
Thomas Haller
c03a534963 core: implement setting MDNS setting for systemd
The connection.mdns setting is a per-connection setting,
so one might expect that one activated device can only have
one MDNS setting at a time.

However, with certain VPN plugins (those that don't have their
own IP interface, like libreswan), the VPN configuration is merged
into the configuration of the device. So, in this case, there
might be multiple settings for one device that must be merged.

We already have a mechanism for that. It's NMIP4Config. Let NMIP4Config
track this piece of information. Although, stricitly speaking this
is not tied to IPv4, the alternative would be to introduce a new
object to track such data, which would be a tremendous effort
and more complicated then this.

Luckily, NMDnsManager and NMDnsPlugin are already equipped to
handle multiple NMIPConfig instances per device (IPv4 vs. IPv6,
and Device vs. VPN).

Also make "connection.mdns" configurable via global defaults in
NetworkManager.conf.
2018-01-09 14:24:54 +01:00
Beniamino Galvani
da4c9e51a0 ip-tunnel: add support for tunnel flags
Implement support for IP tunnel flags. Currently only some IPv6 tunnel
flags are supported. Example:

 # nmcli connection add type ip-tunnel mode ip6ip6 \
   ip-tunnel.flags ip6-ign-encap-limit,ip6-use-orig-tclass \
   ifname abc ip-tunnel.parent ens8 ipv4.method disabled \
   ipv6.method manual ipv6.address ::8888 remote ::42

 # ip -d l
  61: abc@ens8: <NOARP,UP,LOWER_UP> mtu 1460 qdisc noqueue ...
    link/tunnel6 :: brd ::42 promiscuity 0
    ip6tnl ip6ip6 remote ::42 local :: dev ens8 encaplimit none
    hoplimit 0 tclass inherit ...

https://bugzilla.gnome.org/show_bug.cgi?id=791846
2018-01-05 18:25:08 +01:00
Thomas Haller
24695a6d1c wifi/iwd: fix type-description for NMDeviceIwd
The NMDeviceIwd is an alternative implementation of
NMDeviceWifi, hence, it must also look like a Wi-Fi
device.

Fix the type-description to be "wifi".
2017-12-27 10:55:09 +01:00
Thomas Haller
0775602574 device: don't keep a clone of the type-description for each device instance
Instead, intern the string and cache it in the NMDeviceClass instance.
It anyway depends entirely on the GObject type (name), hence it should
also be cached at the type.
2017-12-27 09:52:40 +01:00
Thomas Haller
969eb98d52 core: extend nm_match_spec_device_by_pllink() with the device-type
nm_match_spec_device_by_pllink() does not support matching on all parameters,
unlike nm_match_spec_device(). The reason is that certain parameters are
only available when having a NMDevice instance.

Add an argument "match_device_type", so that the caller can inject the
device type to be used. Note that for NMDevice, the device-type is
nm_device_get_type_description(), which usually depends on the device
class only. The only caller of nm_match_spec_device_by_pllink() is the
wifi factory, and it already knows that it wants to create a device of
type NMDeviceWifi. Hence, it knows and can specify "wifi" as
match_device_type.
2017-12-27 09:42:05 +01:00