colin/NetworkManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

policy: refresh IPv4 forwarding after connection activation and disconnection

Browse Source 
Previously, IPv4 shared method will automatically enable the IPv4
global forwarding, all the per-interface level IPv4 forwarding settings
may be changed to match the global setting. Also, all the per-inteface
level forwarding settings can not be restored when deactivating the
shared connection. This is problematic as it may disrupt custom
configurations and lead to inconsistent forwarding behavior across
different network interfaces.

To address this, the implementation now ensures that the original
per-interface forwarding settings are preserved. Upon activating a
shared connection, instead of enabling IPv4 global forwarding
automatically, the per-interface forwarding is enabled on all other
connections unless a connection explicitly has the forwarding set to
"no" in its configuration. Upon deactivating all shared connection,
per-interface forwarding settings are restored to sysctl's default
value. Furthermore, deactivating any connection explicitly sets the
forwarding to sysctl's default value ensuring that network forwarding
behavior remains consistent.
This commit is contained in:
Wen Liang
2025-01-15 11:30:59 -05:00
parent a8a2e6d727
commit 2ad5fbf025
7 changed files with 141 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
man/NetworkManager.conf.xml
View File

@@ -943,7 +943,7 @@ ipv6.ip6-privacy=0
</varlistentry>
<varlistentry>
<term><varname>ipv4.forwarding</varname></term>
<listitem><para>Whether to configure IPv4 sysctl interface-specific forwarding. When enabled, the interface will act as a router to forward the IPv4 packet from one interface to another. If left unspecified, "auto" is used, so NetworkManager sets the IPv4 forwarding if any shared connection is active, or it will use the kernel default value otherwise. The accepted values are: 0: disabled, 1: enabled, 2: auto, 3: ignored (leave the forwarding unchanged).</para></listitem>
<listitem><para>Whether to configure IPv4 sysctl interface-specific forwarding. When enabled, the interface will act as a router to forward the IPv4 packet from one interface to another. If left unspecified, "auto" is used, so NetworkManager sets the IPv4 forwarding if any shared connection is active, or it will use the kernel default value otherwise. The "ipv4.forwarding" property is ignored when "ipv4.method" is set to "shared", because forwarding is always enabled in this case. The accepted values are: 0: disabled, 1: enabled, 2: auto, 3: ignored (leave the forwarding unchanged).</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>ipv4.routed-dns</varname></term>

51
src/core/devices/nm-device.c
View File

@@ -778,6 +778,7 @@ typedef struct _NMDevicePrivate {
char *prop_ip_iface; /* IP interface D-Bus property */
GList *ping_operations;
GSource *ping_timeout;
bool refresh_forwarding_done : 1;
} NMDevicePrivate;
G_DEFINE_ABSTRACT_TYPE(NMDevice, nm_device, NM_TYPE_DBUS_OBJECT)
@@ -2108,8 +2109,8 @@ _prop_get_ipvx_dhcp_send_hostname(NMDevice *self, int addr_family)
return send_hostname_v2;
}
static NMSettingIPConfigForwarding
_prop_get_ipv4_forwarding(NMDevice *self)
NMSettingIPConfigForwarding
nm_device_get_ipv4_forwarding(NMDevice *self)
{
NMSettingIPConfig *s_ip;
NMSettingIPConfigForwarding forwarding;
@@ -3754,7 +3755,7 @@ nm_device_assume_state_reset(NMDevice *self)
/*****************************************************************************/
static char *
char *
nm_device_sysctl_ip_conf_get(NMDevice *self, int addr_family, const char *property)
{
const char *ifname;
@@ -6613,7 +6614,7 @@ concheck_update_state(NMDevice *self,
_dev_l3_register_l3cds(self, priv->l3cfg, TRUE, NM_TERNARY_DEFAULT);
}
static const char *
const char *
nm_device_get_effective_ip_config_method(NMDevice *self, int addr_family)
{
NMDeviceClass *klass;
@@ -13087,7 +13088,7 @@ activate_stage3_ip_config_for_addr_family(NMDevice *self, int addr_family)
goto out_devip;
if (IS_IPv4) {
NMSettingIPConfigForwarding ipv4_forwarding = _prop_get_ipv4_forwarding(self);
NMSettingIPConfigForwarding ipv4_forwarding = nm_device_get_ipv4_forwarding(self);
if (NM_IN_SET(ipv4_forwarding,
NM_SETTING_IP_CONFIG_FORWARDING_NO,
@@ -13523,19 +13524,6 @@ _dev_ipshared4_init(NMDevice *self)
break;
}
if (nm_platform_sysctl_get_int32(nm_device_get_platform(self),
NMP_SYSCTL_PATHID_ABSOLUTE("/proc/sys/net/ipv4/ip_forward"),
-1)
== 1) {
/* nothing to do. */
} else if (!nm_platform_sysctl_set(nm_device_get_platform(self),
NMP_SYSCTL_PATHID_ABSOLUTE("/proc/sys/net/ipv4/ip_forward"),
"1")) {
errsv = errno;
_LOGW_ipshared(AF_INET, "error enabling IPv4 forwarding: %s", nm_strerror_native(errsv));
return FALSE;
}
if (nm_platform_sysctl_get_int32(nm_device_get_platform(self),
NMP_SYSCTL_PATHID_ABSOLUTE("/proc/sys/net/ipv4/ip_dynaddr"),
-1)
@@ -16870,6 +16858,8 @@ _cleanup_generic_post(NMDevice *self, NMDeviceStateReason reason, CleanupType cl
priv->v4_route_table_all_sync_before = FALSE;
priv->v6_route_table_all_sync_before = FALSE;
priv->refresh_forwarding_done = FALSE;
priv->mtu_force_set_done = FALSE;
priv->needs_ip6_subnet = FALSE;
@@ -16915,6 +16905,7 @@ nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanu
NMDevicePrivate *priv;
NMDeviceClass *klass = NM_DEVICE_GET_CLASS(self);
int ifindex;
gint32 default_forwarding_v4;
g_return_if_fail(NM_IS_DEVICE(self));
@@ -16937,6 +16928,17 @@ nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanu
nm_device_sysctl_ip_conf_set(self, AF_INET6, "use_tempaddr", "0");
}
/* Restoring the device's forwarding to the sysctl default is necessary because
* `refresh_forwarding()` only updates forwarding on activated devices. */
default_forwarding_v4 = nm_platform_sysctl_get_int32(
nm_device_get_platform(self),
NMP_SYSCTL_PATHID_ABSOLUTE("/proc/sys/net/ipv4/conf/default/forwarding"),
0);
nm_device_sysctl_ip_conf_set(self,
AF_INET,
"forwarding",
default_forwarding_v4 == 1 ? "1" : "0");
/* Call device type-specific deactivation */
if (klass->deactivate)
klass->deactivate(self);
@@ -18877,6 +18879,19 @@ nm_device_get_hostname_from_dns_lookup(NMDevice *self, int addr_family, gboolean
return nm_assert_unreachable_val(NULL);
}
gboolean
nm_device_get_refresh_forwarding_done(NMDevice *self)
{
return NM_DEVICE_GET_PRIVATE(self)->refresh_forwarding_done;
}
void
nm_device_set_refresh_forwarding_done(NMDevice *self, gboolean is_refresh_forwarding_done)
{
NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE(self);
priv->refresh_forwarding_done = is_refresh_forwarding_done;
}
/*****************************************************************************/
static const char *

10
src/core/devices/nm-device.h
View File

@@ -854,4 +854,14 @@ void nm_routing_rules_sync(NMConnection *applied_connection,
NMDevice *self,
NMNetns *netns);
NMSettingIPConfigForwarding nm_device_get_ipv4_forwarding(NMDevice *self);
const char *nm_device_get_effective_ip_config_method(NMDevice *self, int addr_family);
char *nm_device_sysctl_ip_conf_get(NMDevice *self, int addr_family, const char *property);
gboolean nm_device_get_refresh_forwarding_done(NMDevice *self);
void nm_device_set_refresh_forwarding_done(NMDevice *self, gboolean is_refresh_forwarding_done);
#endif /* __NETWORKMANAGER_DEVICE_H__ */

95
src/core/nm-policy.c
View File

@@ -18,6 +18,7 @@
#include "NetworkManagerUtils.h"
#include "devices/nm-device.h"
#include "devices/nm-device-factory.h"
#include "devices/nm-device-private.h"
#include "dns/nm-dns-manager.h"
#include "nm-act-request.h"
#include "nm-auth-utils.h"
@@ -97,7 +98,6 @@ typedef struct {
bool updating_dns : 1;
GArray *ip6_prefix_delegations; /* pool of ip6 prefixes delegated to all devices */
} NMPolicyPrivate;
struct _NMPolicy {
@@ -2011,6 +2011,65 @@ unblock_autoconnect_for_ports_for_sett_conn(NMPolicy *self, NMSettingsConnection
unblock_autoconnect_for_ports(self, controller_device, controller_uuid_settings, NULL);
}
static void
refresh_forwarding(NMPolicy *self, NMDevice *device, gboolean is_activated_shared_device)
{
NMActiveConnection *ac;
NMDevice *tmp_device;
NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE(self);
const CList *tmp_lst;
gboolean any_shared_active = false;
gint32 default_forwarding_v4;
const char *new_value = NULL;
/* FIXME: This implementation is still inefficient because refresh_forwarding()
* is called every time a device goes up or down, requiring a full scan of all
* active connections to determine if any shared connection is active. */
nm_manager_for_each_active_connection (priv->manager, ac, tmp_lst) {
NMSettingIPConfig *s_ip;
NMDevice *to_device = nm_active_connection_get_device(ac);
if (to_device) {
s_ip = nm_device_get_applied_setting(to_device, NM_TYPE_SETTING_IP4_CONFIG);
if (s_ip) {
if (nm_streq0(nm_device_get_effective_ip_config_method(to_device, AF_INET),
NM_SETTING_IP4_CONFIG_METHOD_SHARED)) {
any_shared_active = true;
break;
}
}
}
}
default_forwarding_v4 = nm_platform_sysctl_get_int32(
NM_PLATFORM_GET,
NMP_SYSCTL_PATHID_ABSOLUTE("/proc/sys/net/ipv4/conf/default/forwarding"),
0);
new_value = any_shared_active ? "1" : (default_forwarding_v4 ? "1" : "0");
nm_manager_for_each_device (priv->manager, tmp_device, tmp_lst) {
NMDeviceState state;
NMSettingIPConfigForwarding ipv4_forwarding;
state = nm_device_get_state(tmp_device);
if (state != NM_DEVICE_STATE_ACTIVATED)
continue;
ipv4_forwarding = nm_device_get_ipv4_forwarding(tmp_device);
if (ipv4_forwarding == NM_SETTING_IP_CONFIG_FORWARDING_AUTO
|| (device == tmp_device && is_activated_shared_device)) {
gs_free char *sysctl_value = NULL;
sysctl_value = nm_device_sysctl_ip_conf_get(tmp_device, AF_INET, "forwarding");
if (!nm_streq0(sysctl_value, new_value))
nm_device_sysctl_ip_conf_set(tmp_device, AF_INET, "forwarding", new_value);
}
}
}
static void
activate_port_or_children_connections(NMPolicy *self,
NMDevice *device,
@@ -2155,8 +2214,9 @@ device_state_changed(NMDevice *device,
NMPolicyPrivate *priv = user_data;
NMPolicy *self = _PRIV_TO_SELF(priv);
NMActiveConnection *ac;
NMSettingsConnection *sett_conn = nm_device_get_settings_connection(device);
NMSettingConnection *s_con = NULL;
NMSettingsConnection *sett_conn = nm_device_get_settings_connection(device);
NMSettingConnection *s_con = NULL;
gboolean is_activated_shared_device = FALSE;
switch (nm_device_state_reason_check(reason)) {
case NM_DEVICE_STATE_REASON_GSM_SIM_PIN_REQUIRED:
@@ -2272,6 +2332,10 @@ device_state_changed(NMDevice *device,
}
}
}
if (!nm_device_get_refresh_forwarding_done(device)) {
refresh_forwarding(self, device, FALSE);
nm_device_set_refresh_forwarding_done(device, TRUE);
}
break;
case NM_DEVICE_STATE_ACTIVATED:
if (nm_device_get_device_type(device) == NM_DEVICE_TYPE_OVS_INTERFACE) {
@@ -2304,11 +2368,20 @@ device_state_changed(NMDevice *device,
update_system_hostname(self, "routing and dns", TRUE);
nm_dns_manager_end_updates(priv->dns_manager, __func__);
is_activated_shared_device =
nm_streq0(nm_device_get_effective_ip_config_method(device, AF_INET),
NM_SETTING_IP4_CONFIG_METHOD_SHARED);
refresh_forwarding(self, device, is_activated_shared_device);
nm_device_set_refresh_forwarding_done(device, FALSE);
break;
case NM_DEVICE_STATE_UNMANAGED:
case NM_DEVICE_STATE_UNAVAILABLE:
if (old_state > NM_DEVICE_STATE_DISCONNECTED)
update_routing_and_dns(self, FALSE, device);
if (!nm_device_get_refresh_forwarding_done(device)) {
refresh_forwarding(self, device, FALSE);
nm_device_set_refresh_forwarding_done(device, TRUE);
}
break;
case NM_DEVICE_STATE_DEACTIVATING:
if (sett_conn) {
@@ -2344,6 +2417,10 @@ device_state_changed(NMDevice *device,
}
}
ip6_remove_device_prefix_delegations(self, device);
if (!nm_device_get_refresh_forwarding_done(device)) {
refresh_forwarding(self, device, FALSE);
nm_device_set_refresh_forwarding_done(device, TRUE);
}
break;
case NM_DEVICE_STATE_DISCONNECTED:
g_signal_handlers_disconnect_by_func(device, device_dns_lookup_done, self);
@@ -2360,6 +2437,10 @@ device_state_changed(NMDevice *device,
/* Device is now available for auto-activation */
nm_policy_device_recheck_auto_activate_schedule(self, device);
if (!nm_device_get_refresh_forwarding_done(device)) {
refresh_forwarding(self, device, FALSE);
nm_device_set_refresh_forwarding_done(device, TRUE);
}
break;
case NM_DEVICE_STATE_PREPARE:
@@ -2375,6 +2456,10 @@ device_state_changed(NMDevice *device,
g_object_weak_unref(G_OBJECT(ac), pending_ac_gone, self);
g_object_unref(self);
}
if (!nm_device_get_refresh_forwarding_done(device)) {
refresh_forwarding(self, device, FALSE);
nm_device_set_refresh_forwarding_done(device, TRUE);
}
break;
case NM_DEVICE_STATE_IP_CONFIG:
/* We must have secrets if we got here. */
@@ -2385,6 +2470,10 @@ device_state_changed(NMDevice *device,
sett_conn,
NM_SETTINGS_AUTOCONNECT_BLOCKED_REASON_FAILED,
FALSE);
if (!nm_device_get_refresh_forwarding_done(device)) {
refresh_forwarding(self, device, FALSE);
nm_device_set_refresh_forwarding_done(device, TRUE);
}
break;
case NM_DEVICE_STATE_SECONDARIES:
if (sett_conn)

2
src/libnm-core-impl/nm-setting-ip-config.c
View File

@@ -7151,6 +7151,8 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
* will act as a router to forward the packet from one interface to another. When set to
* %NM_SETTING_IP_CONFIG_FORWARDING_DEFAULT, the value from global configuration is used;
* if no global default is defined, %NM_SETTING_IP_CONFIG_FORWARDING_AUTO will be used.
* The #NMSettingIPConfig:forwarding property is ignored when #NMSettingIPConfig:method
* is set to "shared", because forwarding is always enabled in this case.
* The accepted values are:
* %NM_SETTING_IP_CONFIG_FORWARDING_DEFAULT: use global default.
* %NM_SETTING_IP_CONFIG_FORWARDING_NO: disabled.

4
src/libnmc-setting/settings-docs.h.in
View File

@@ -200,7 +200,7 @@
#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_OPTIONS N_("DNS options for /etc/resolv.conf as described in resolv.conf(5) manual. The currently supported options are \"attempts\", \"debug\", \"edns0\", \"ndots\", \"no-aaaa\", \"no-check-names\", \"no-reload\", \"no-tld-query\", \"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", \"use-vc\". See the resolv.conf(5) manual. Note that there is a distinction between an unset (default) list and an empty list. In nmcli, to unset the list set the value to \"\". To set an empty list, set it to \" \". Currently, an unset list has the same meaning as an empty list. That might change in the future. The \"trust-ad\" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are automatically added. The valid \"ipv4.dns-options\" and \"ipv6.dns-options\" get merged together.")
#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_PRIORITY N_("DNS servers priority. The relative priority for DNS servers specified by this setting. A lower numerical value is better (higher priority). Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles. Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections. It does not disambiguate multiple DNS servers within the same connection profile. When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices. When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the \"rotate\" option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered. When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain. Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually). When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins. If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured.")
#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_SEARCH N_("List of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names. When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting. When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting \"ignore-auto-dns\". Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15).")
#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_FORWARDING N_("Whether to configure sysctl interface-specific forwarding. When enabled, the interface will act as a router to forward the packet from one interface to another. When set to \"default\" (-1), the value from global configuration is used; if no global default is defined, \"auto\" (2) will be used. The accepted values are: \"default\" (-1): use global default. \"no\" (0): disabled. \"yes\" (1): enabled. \"auto\" (2): enable if any shared connection is active, use kernel default otherwise. \"ignore\" (3): leave the forwarding unchanged.")
#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_FORWARDING N_("Whether to configure sysctl interface-specific forwarding. When enabled, the interface will act as a router to forward the packet from one interface to another. When set to \"default\" (-1), the value from global configuration is used; if no global default is defined, \"auto\" (2) will be used. The \"forwarding\" property is ignored when \"method\" is set to \"shared\", because forwarding is always enabled in this case. The accepted values are: \"default\" (-1): use global default. \"no\" (0): disabled. \"yes\" (1): enabled. \"auto\" (2): enable if any shared connection is active, use kernel default otherwise. \"ignore\" (3): leave the forwarding unchanged.")
#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_GATEWAY N_("The gateway associated with this configuration. This is only meaningful if \"addresses\" is also set. Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if \"never-default\" is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length. Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See \"ip4-auto-default-route\".")
#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_IGNORE_AUTO_DNS N_("When \"method\" is set to \"auto\" and this property to TRUE, automatically configured name servers and search domains are ignored and only name servers and search domains specified in the \"dns\" and \"dns-search\" properties, if any, are used.")
#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_IGNORE_AUTO_ROUTES N_("When \"method\" is set to \"auto\" and this property to TRUE, automatically configured routes are ignored and only routes specified in the \"routes\" property, if any, are used.")
@@ -236,7 +236,7 @@
#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_OPTIONS N_("DNS options for /etc/resolv.conf as described in resolv.conf(5) manual. The currently supported options are \"attempts\", \"debug\", \"edns0\", \"ndots\", \"no-aaaa\", \"no-check-names\", \"no-reload\", \"no-tld-query\", \"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", \"use-vc\" and \"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"no-ip6-dotint\". See the resolv.conf(5) manual. Note that there is a distinction between an unset (default) list and an empty list. In nmcli, to unset the list set the value to \"\". To set an empty list, set it to \" \". Currently, an unset list has the same meaning as an empty list. That might change in the future. The \"trust-ad\" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are automatically added. The valid \"ipv4.dns-options\" and \"ipv6.dns-options\" get merged together.")
#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_PRIORITY N_("DNS servers priority. The relative priority for DNS servers specified by this setting. A lower numerical value is better (higher priority). Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles. Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections. It does not disambiguate multiple DNS servers within the same connection profile. When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices. When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the \"rotate\" option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered. When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain. Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually). When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins. If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured.")
#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_SEARCH N_("List of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names. When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting. When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting \"ignore-auto-dns\". Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15).")
#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_FORWARDING N_("Whether to configure sysctl interface-specific forwarding. When enabled, the interface will act as a router to forward the packet from one interface to another. When set to \"default\" (-1), the value from global configuration is used; if no global default is defined, \"auto\" (2) will be used. The accepted values are: \"default\" (-1): use global default. \"no\" (0): disabled. \"yes\" (1): enabled. \"auto\" (2): enable if any shared connection is active, use kernel default otherwise. \"ignore\" (3): leave the forwarding unchanged.")
#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_FORWARDING N_("Whether to configure sysctl interface-specific forwarding. When enabled, the interface will act as a router to forward the packet from one interface to another. When set to \"default\" (-1), the value from global configuration is used; if no global default is defined, \"auto\" (2) will be used. The \"forwarding\" property is ignored when \"method\" is set to \"shared\", because forwarding is always enabled in this case. The accepted values are: \"default\" (-1): use global default. \"no\" (0): disabled. \"yes\" (1): enabled. \"auto\" (2): enable if any shared connection is active, use kernel default otherwise. \"ignore\" (3): leave the forwarding unchanged.")
#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_GATEWAY N_("The gateway associated with this configuration. This is only meaningful if \"addresses\" is also set. Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if \"never-default\" is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length. Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See \"ip4-auto-default-route\".")
#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_IGNORE_AUTO_DNS N_("When \"method\" is set to \"auto\" and this property to TRUE, automatically configured name servers and search domains are ignored and only name servers and search domains specified in the \"dns\" and \"dns-search\" properties, if any, are used.")
#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_IGNORE_AUTO_ROUTES N_("When \"method\" is set to \"auto\" and this property to TRUE, automatically configured routes are ignored and only routes specified in the \"routes\" property, if any, are used.")

2
src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
View File

@@ -1403,7 +1403,7 @@
format="choice (NMTernary)"
values="default (-1), false/no (0), true/yes (1)" />
<property name="forwarding"
nmcli-description="Whether to configure sysctl interface-specific forwarding. When enabled, the interface will act as a router to forward the packet from one interface to another. When set to &quot;default&quot; (-1), the value from global configuration is used; if no global default is defined, &quot;auto&quot; (2) will be used. The accepted values are: &quot;default&quot; (-1): use global default. &quot;no&quot; (0): disabled. &quot;yes&quot; (1): enabled. &quot;auto&quot; (2): enable if any shared connection is active, use kernel default otherwise. &quot;ignore&quot; (3): leave the forwarding unchanged."
nmcli-description="Whether to configure sysctl interface-specific forwarding. When enabled, the interface will act as a router to forward the packet from one interface to another. When set to &quot;default&quot; (-1), the value from global configuration is used; if no global default is defined, &quot;auto&quot; (2) will be used. The &quot;forwarding&quot; property is ignored when &quot;method&quot; is set to &quot;shared&quot;, because forwarding is always enabled in this case. The accepted values are: &quot;default&quot; (-1): use global default. &quot;no&quot; (0): disabled. &quot;yes&quot; (1): enabled. &quot;auto&quot; (2): enable if any shared connection is active, use kernel default otherwise. &quot;ignore&quot; (3): leave the forwarding unchanged."
format="choice (NMSettingIPConfigForwarding)"
values="default (-1), no (0), yes (1), auto (2), ignore (3)" />
<property name="dhcp-hostname"