Find a file
Thomas Haller c1ec829099 libnm/secret-agent: rework NMSecretAgentOld
Note that the name "NMSecretAgentOld" comes from when libnm was forked
from libnm-glib. There was a plan to rework the secret agent API and
replace it by a better one. That didn't happen (yet), instead our one
and only agent implementation is still lacking. Don't add a new API, instead
try to improve the existing one, without breaking existing users. Just
get over the fact that the name "NMSecretAgentOld" is ugly.

Also note how nm-applet uses NMSecretAgentOld. It subtypes a class
AppletAgent. The constructor applet_agent_new() is calling the synchronous
g_initable_init() initialization with auto-register enabled. As it was,
g_initable_init() would call nm_secret_agent_old_register(), and if the
"Register" call failed, initialization failed for good. There are even
unit tests that test this behavior. This is bad behavior. It means, when
you start nm-applet without NetworkManager running, it will fail to create
the AppletAgent instance. It would hence be the responsibility of the applet
to recover from this situation (e.g. by retrying after timeout or watching
the D-Bus name owner). Of course, nm-applet doesn't do that and won't recover
from such a failure.
NMSecretAgentOld must try hard not to fail and recover automatically. The
user of the API is not interested in implementing the registration,
unregistration and retry handling. Instead, it should just work best
effort and transparently to the user of the API.

Differences:

- no longer use gdbus-codegen generate bindings. Use GDBusConnection
  directly instead. These generated proxies complicate the code by
  introducing an additional, stateful layer.

- properly handle GMainContext and synchronous initialization by using an
  internal GMainContext.
  With this NMSecretAgentOld can be used in a multi threaded context
  with separate GMainContext. This does not mean that the object
  itself became thread safe, but that the GMainContext gives the means
  to coordinate multi-threaded access.

- there are no more blocking calls except g_initiable_init() which
  iterates an internal GMainContext until initialization completes.

- obtaining the Unix user ID with "GetConnectionUnixUser" to authenticate
  the server is now done asynchronously and only once per name-owner.

- NMSecretAgentOld will now register/export the Agent D-Bus object
  already during initialization and stay registered as long as the
  instance is alive. This is because usually registering a D-Bus
  object would not fail, unless the D-Bus path is already taken.
  Such an error would mean that another agent is registered for the same
  GDBusConnection, that likely would be a bug in the caller. Hence,
  such an issue is truly non-recoverable and should be reported early to
  the user. There is a change in behavior compared to before, where previously
  the D-Bus object would only be registered while the instance is enabled.
  This makes a difference if the user intended to keep the NMSecretAgentOld
  instance around in an unregistered state.
  Note that nm_secret_agent_old_destroy() was added to really unregister
  the D-Bus object. A destroyed instance can no longer be registered.

- the API no longer fully exposes the current registration state. The
  user either enables or disables the agent. Then, in the background
  NMSecretAgentOld will register, and serve requests as they come. It
  will also always automatically re-register and it can de-facto no
  longer fail. That is, there might be a failure to register, or the
  NetworkManager peer might not be authenticated (non-root) or there
  might be some other error, or NetworkManager might not be running.
  But such errors are not exposed to the user. The instance is just not
  able to provide the secrets in those cases, but it may recover if the
  problem can be resolved.

- In particular, it makes no sense that nm_secret_agent_old_register*()
  fails, returns an error, or waits until registration is complete. This
  API is now only to enable/disable the agent. It is idempotent and
  won't fail (there is a catch, see next point).
  In particular, nm_secret_agent_old_unregister*() cannot fail anymore.

- However, with the previous point there is a problem/race. When you create
  a NMSecretAgentOld instance and immediately afterwards activate a
  profile, then you want to be sure that the registration is complete
  first. Otherwise, NetworkManager might fail the activation because
  no secret agent registered yet. A partial solution for this is
  that g_initiable_init()/g_async_initable_init_async() will block
  until registration is complete (or with or without success). That means,
  if NetworkManager is running, initializing the NMSecretAgentOld will
  wait until registration is complete (or failed). However, that does not
  solve the race if NetworkManager was not running when creating the
  instance.
  To solve that race, the user may call nm_secret_agent_old_register_async()
  and wait for the command to finish before starting activating. While
  async registration no longer fails (in the sense of leaving the agent
  permanently disconnected), it will try to ensure that we are
  successfully registered and ready to serve requests. By using this
  API correctly, a race can be avoided and the user can know that the
  instance is now ready to serve request.
2020-01-28 10:54:14 +01:00
clients clients: avoid compiler warning about redefining NDEBUG for qrcodegen 2020-01-15 22:25:21 +01:00
contrib clients: polkit-agent: implement polkit agent without using libpolkit 2019-12-24 10:13:51 +01:00
data build/meson: cleanup configuration_data() for paths 2019-11-22 15:59:31 +01:00
dispatcher dispatcher: silently ignore empty files 2019-11-28 13:44:57 +01:00
docs core,libnm: add VRF support 2020-01-14 09:51:56 +01:00
examples libnm: export interface flags 2019-11-22 10:18:26 +01:00
introspection core: drop "Groups" property from WifiP2PPeer D-Bus API 2020-01-15 13:54:45 +01:00
libnm libnm/secret-agent: rework NMSecretAgentOld 2020-01-28 10:54:14 +01:00
libnm-core shared/tests/trivial: rename nmtst_main_context_iterate_until() to nmtst_main_context_iterate_until_assert() 2020-01-28 10:54:14 +01:00
m4 all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
man man: document connectivity.enabled option in NetworkManager.conf manual 2019-12-28 15:20:06 +01:00
po libnm/secret-agent: rework NMSecretAgentOld 2020-01-28 10:54:14 +01:00
shared libnm/tests: cleanup add_device_common() test helper 2020-01-28 10:54:14 +01:00
src core: improve implementation of NM_DEVICE_DEFINE_LINK_TYPES() macro 2020-01-28 10:42:08 +01:00
tools cloud-setup: add tool for automatic IP configuration in cloud 2019-11-28 19:52:18 +01:00
vapi all: goodbye libnm-glib 2019-04-16 15:52:27 +02:00
.dir-locals.el misc: add toplevel .dir-locals file that tells Emacs to show trailing whitespace 2013-03-08 15:15:28 +01:00
.gitignore shared: move "shared/nm-utils/tests/test-shared-general" to "shared/nm-glib-aux/tests" 2019-12-10 09:17:17 +01:00
.gitlab-ci.yml gitlab-ci: fix generating "pages" after switching to Fedora 30 for main build 2019-12-13 11:48:25 +01:00
.mailmap mailmap: update user 2018-10-01 12:02:55 +02:00
.travis.yml travis-ci: update build platform to Ubuntu 16.04 (xenial) 2019-12-02 17:34:52 +01:00
AUTHORS misc: update maintainers and authors 2016-04-21 13:39:03 -05:00
autogen.sh all: goodbye libnm-glib 2019-04-16 15:52:27 +02:00
ChangeLog all: point git references to the GitLab instance 2018-08-27 11:36:56 +02:00
config-extra.h.meson build: remove duplicate and unused RUNDIR define 2019-05-17 21:24:18 +02:00
config-extra.h.mk build: regenerate config-extra.h if configure was re-run with different arguments 2019-09-25 15:55:37 +02:00
config.h.meson clients: polkit-agent: implement polkit agent without using libpolkit 2019-12-24 10:13:51 +01:00
configure.ac autotools: define the polkit-agent package prefix when building without polkit-devel 2019-12-24 13:39:49 +01:00
CONTRIBUTING CONTRIBUTING: update comment about requiring LGPL-2.1+ license instead of LGPL-2.0+ 2019-10-01 07:50:52 +02:00
COPYING COPYING: make sure we ship the relevant license texts 2019-09-10 11:10:52 +02:00
COPYING.GFDL COPYING: make sure we ship the relevant license texts 2019-09-10 11:10:52 +02:00
COPYING.LGPL COPYING: make sure we ship the relevant license texts 2019-09-10 11:10:52 +02:00
linker-script-binary.ver iface-helper/build: add linker version script 2016-10-13 21:33:33 +02:00
linker-script-devices.ver devices/build: use one linker-script-devices.ver for all device plugins 2016-10-13 21:36:06 +02:00
linker-script-settings.ver settings/build: add linker version script for settings plugins 2016-10-13 21:33:33 +02:00
MAINTAINERS misc: update maintainers and authors 2016-04-21 13:39:03 -05:00
Makefile.am build: fix linking of "src/devices/wifi/tests/test-devices-wifi" 2020-01-15 17:43:07 +01:00
Makefile.examples examples: add examples/python/gi/nm-update2.py example script 2019-07-25 22:02:00 +02:00
Makefile.glib all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
Makefile.vapigen build: fix make always re-making vapigen target 2016-10-21 18:46:03 +02:00
meson.build clients: polkit-agent: implement polkit agent without using libpolkit 2019-12-24 10:13:51 +01:00
meson_options.txt core: add main.auth-polkit option "root-only" 2019-12-11 13:13:05 +01:00
NetworkManager.pc.in build: update NetworkManager.pc 2013-01-29 16:17:30 -05:00
NEWS release: bump version to 1.23.1-dev after 1.22.0 release 2019-12-17 09:58:12 +01:00
README all: drop empty first line from sources 2019-06-11 10:15:06 +02:00
RELICENSE.md license: add Iñigo to RELICENSE.md 2020-01-14 17:30:44 +01:00
TODO all: say Wi-Fi instead of "wifi" or "WiFi" 2018-11-29 17:53:35 +01:00
valgrind.suppressions all: goodbye libnm-glib 2019-04-16 15:52:27 +02:00

******************
NetworkManager core daemon has moved to gitlab.freedesktop.org!

git clone https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git
******************


Networking that Just Works
--------------------------

NetworkManager attempts to keep an active network connection available at all
times.  The point of NetworkManager is to make networking configuration and
setup as painless and automatic as possible.  NetworkManager is intended to
replace default route, replace other routes, set IP addresses, and in general
configure networking as NM sees fit (with the possibility of manual override as
necessary).  In effect, the goal of NetworkManager is to make networking Just
Work with a minimum of user hassle, but still allow customization and a high
level of manual network control.  If you have special needs, we'd like to hear
about them, but understand that NetworkManager is not intended for every
use-case.

NetworkManager will attempt to keep every network device in the system up and
active, as long as the device is available for use (has a cable plugged in,
the killswitch isn't turned on, etc).  Network connections can be set to
'autoconnect', meaning that NetworkManager will make that connection active
whenever it and the hardware is available.

"Settings services" store lists of user- or administrator-defined "connections",
which contain all the settings and parameters required to connect to a specific
network.  NetworkManager will _never_ activate a connection that is not in this
list, or that the user has not directed NetworkManager to connect to.


How it works:

The NetworkManager daemon runs as a privileged service (since it must access
and control hardware), but provides a D-Bus interface on the system bus to
allow for fine-grained control of networking.  NetworkManager does not store
connections or settings, it is only the mechanism by which those connections
are selected and activated.

To store pre-defined network connections, two separate services, the "system
settings service" and the "user settings service" store connection information
and provide these to NetworkManager, also via D-Bus.  Each settings service
can determine how and where it persistently stores the connection information;
for example, the GNOME applet stores its configuration in GConf, and the system
settings service stores its config in distro-specific formats, or in a distro-
agnostic format, depending on user/administrator preference.

A variety of other system services are used by NetworkManager to provide
network functionality: wpa_supplicant for wireless connections and 802.1x
wired connections, pppd for PPP and mobile broadband connections, DHCP clients
for dynamic IP addressing, dnsmasq for proxy nameserver and DHCP server
functionality for internet connection sharing, and avahi-autoipd for IPv4
link-local addresses.  Most communication with these daemons occurs, again,
via D-Bus.


Why doesn't my network Just Work?

Driver problems are the #1 cause of why NetworkManager sometimes fails to
connect to wireless networks.  Often, the driver simply doesn't behave in a
consistent manner, or is just plain buggy.  NetworkManager supports _only_
those drivers that are shipped with the upstream Linux kernel, because only
those drivers can be easily fixed and debugged.  ndiswrapper, vendor binary
drivers, or other out-of-tree drivers may or may not work well with
NetworkManager, precisely because they have not been vetted and improved by the
open-source community, and because problems in these drivers usually cannot
be fixed.

Sometimes, command-line tools like 'iwconfig' will work, but NetworkManager will
fail.  This is again often due to buggy drivers, because these drivers simply
aren't expecting the dynamic requests that NetworkManager and wpa_supplicant
make.  Driver bugs should be filed in the bug tracker of the distribution being
run, since often distributions customize their kernel and drivers.

Sometimes, it really is NetworkManager's fault.  If you think that's
the case, please file a bug at:

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/issues

Attaching NetworkManager debug logs from the journal (or wherever your
distribution directs syslog's 'daemon' facility output, as
/var/log/messages or /var/log/daemon.log) is often very helpful, and
(if you can get) a working wpa_supplicant config file helps
enormously.  See the logging section of file
contrib/fedora/rpm/NetworkManager.conf for how to enable debug logging
in NetworkManager.