Commit Graph

33665 Commits

Author SHA1 Message Date
Jan Vaclav
84bcc0eab9 platform/vlan: fix incorrect type for ingress/egress qos mappings
The kernel was updated to add stricter validation to netlink messages,
which revealed this bug:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6c21660fe221a15c789dee2bc2fd95516bc5aeaf

Fixes: a5ea141956 ('platform/vlan: add support for ingress/egress-qos-mappings and changing flags')
2025-01-16 11:08:44 +00:00
Jan Vaclav
9ed9037465 ci: use default_distro for coverity job
Previously, the coverity scheduled job seemed to fail
randomly because the image that it expected to use was
not available, due to not depending on the "prep" job.

This commit resolves the problem by making sure
the image is always built when coverity runs.
2025-01-16 11:21:39 +01:00
Beniamino Galvani
7633b5e493 merge: branch 'bg/fix-routed-dns'
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2106
2025-01-15 09:05:01 +01:00
Beniamino Galvani
bf3ecd9031 l3cfg: fix DNS routes
The current approach is flawed. During a commit of the L3
configuration we do a RTM_GETROUTE to find the next-hop to the DNS
server on the current interface, in order to create the DNS route to
inject into the l3cd. However, we haven't added routes to kernel yet
and so the result of the RTM_GETROUTE is going to be wrong.

In some cases, for example when IPv4 DAD is enabled, the bug can't be
easily noticed because we perform multiple commits for the interface,
and the regular routes are already set in kernel from the 2nd commit
on.

To fix the problem, do the following: during a commit we first add
addresses and routes to platform. Then, we create a list of DNS routes
to configure, we collect the old DNS routes, and do a comparison. If
they changed, we need to add the DNS routes to platform in a 2nd step.

Note that in the previous approach we tracked the routes in the
committed-l3cd object of the l3cfg, and so they were applied to kernel
automatically. Because of the 2-step requirement, that no longer works
and we must apply the DNS routes manually.

Fixes: 5449b18a94 ('core: support automatically adding DNS routes')
2025-01-14 23:31:59 +01:00
Beniamino Galvani
aefc7732f0 l3cfg: add the DNS routing rule only when needed
Don't try to add the routing rule that points to the table containing
DNS routes at every commit.

Instead, look into the platform cache to see if the rule already
exists and add it only when needed.
2025-01-14 23:31:59 +01:00
Wen Liang
d3da1d56fd merge: branch 'wl/fix_dhcp_send_release'
dhcp-client4: do not send release message when there is no lease

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2084
2025-01-14 16:13:38 +00:00
Wen Liang
55710d3d7c n-dhcp4: send request directly to avoid unnecessary retransmission timeout
Using `n_dhcp4_c_connection_start_request()` will cause staying in
`connection->request`, as a result, it will cause the resending of
DHCPRELEASE and DHCPDECLINE message, thus, use
`n_dhcp4_c_connection_send_request()` directly instead to avoid
unnecessary retransmission timeout, as suggested by
f030927a54 (r1531834009).
2025-01-14 10:58:36 -05:00
Wen Liang
bccf031591 n-dhcp4: do not send the release message in wrong connection state
We should not send the DHCP release message when udp socket is still in
the PACKET state, this state is typically used during the discovery and
offer phases, where the client broadcasts DHCP packets like DHCPDISCOVER
and receives responses like DHCPOFFER. At this point, the client has no
lease because it has not yet completed the DHCP handshake.
2025-01-14 10:58:36 -05:00
Wen Liang
96ff17fd48 dhcp-client4: do not send release message when there is no lease
The daemon crashes when NM tries to send the release message when there
is no lease yet and the UDP socket is still in the PACKET state, which
causes an assertion failure as the result.

Add the condition to guarantee that n-dhcp4 only sends the release
message when there is a lease.

Resolves: https://issues.redhat.com/browse/RHEL-69132

Stack trace of the crash:
0  0x00007f5ac248bacc __pthread_kill_implementation (libc.so.6 + 0x8bacc)
1  0x00007f5ac243e686 __GI_raise (libc.so.6 + 0x3e686)
2  0x00007f5ac2428833 __GI_abort (libc.so.6 + 0x28833)
3  0x00007f5ac242875b __assert_fail_base (libc.so.6 + 0x2875b)
4  0x00007f5ac24373c6 __assert_fail (libc.so.6 + 0x373c6)
5  0x00005607ec7f194a n_dhcp4_c_connection_udp_send (NetworkManager + 0x8594a)
6  0x00005607eca228cc n_dhcp4_c_connection_start_request (NetworkManager + 0x2b68cc)
7  0x00005607eca14b31 nm_dhcp_client_stop (NetworkManager + 0x2a8b31)
8  0x00005607eca8a4ce _dev_ipdhcpx_cleanup (NetworkManager + 0x31e4ce)
9  0x00005607ecac144d _cleanup_ip_pre (NetworkManager + 0x35544d)
10 0x00005607ecac3f04 _cleanup_generic_pre (NetworkManager + 0x357f04)
11 0x00005607ecad5006 nm_device_cleanup (NetworkManager + 0x369006)
12 0x00005607ecac5230 _set_state_full (NetworkManager + 0x359230)
13 0x00005607ecac8c4a nm_device_state_changed (NetworkManager + 0x35cc4a)
14 0x00007f5ac2daa47b g_idle_dispatch (libglib-2.0.so.0 + 0x5147b)
15 0x00007f5ac2dadf4f g_main_dispatch (libglib-2.0.so.0 + 0x54f4f)
16 0x00007f5ac2e03268 g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xaa268)
17 0x00007f5ac2dad5a3 g_main_loop_run (libglib-2.0.so.0 + 0x545a3)
18 0x00005607ec7c3eed main (NetworkManager + 0x57eed)
19 0x00007f5ac24295d0 __libc_start_call_main (libc.so.6 + 0x295d0)
20 0x00007f5ac2429680 __libc_start_main_impl (libc.so.6 + 0x29680)
21 0x00005607ec7c43f5 _start (NetworkManager + 0x583f5)
2025-01-14 10:58:36 -05:00
Wen Liang
5993ee8a8a nm-dhcp-client: add argument controlling whether to get next or current lease
In the scenario for sending the release message, we need to guarantee
that NM only sends the release message when the client received a lease
from the server. However, there is some distinction between the
`l3cd_curr` and `l3cd_next` when ACD is pending, because `l3cd_curr` is
NULL but `l3cd_next` is not NULL when ACD is pending. Regardless of
whether ACD is pending or completed, these are all considered the client
have received the release from the server. Therefore, adapt the function
`nm_dhcp_client_get_lease()` to control whether to get next or current
lease.
2025-01-14 10:58:36 -05:00
Fernando Fernandez Mancera
6819f05644 contrib/makerepo.sh: adapt to "fedpkg prep" new behavior
Now "fedpkg prep" command is generating a directory with the "-build"
suffix containing the build directory inside. We need to extract it.

Real example:

If the script is used for a branch related to nm-1-46, the "fedpkg prep"
command will generate a NetworkManager-1.46-build/ directory containing
the NetworkManager-1.46/ sources directory. We just need to move the
NetworkManager-1.46/ out.
2025-01-13 13:29:17 +01:00
Beniamino Galvani
9be28970a6 merge: branch 'bg/encrypted-dns'
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2090
2025-01-08 14:44:08 +01:00
Beniamino Galvani
2b194b9f24 NEWS: update 2025-01-07 15:41:46 +01:00
Beniamino Galvani
8f569814ae libnm-core: remove old DNS parsing functions
They are no longer used.
2025-01-07 15:41:45 +01:00
Beniamino Galvani
dd09af121b dispatcher: fix serialization of DNS servers
In the "Action()" D-Bus method, the "nameservers" key used to contain
an array of binary addresses. If we change the key to contain
something else, there can be problems when the NM and the
NM-dispatcher versions mismatch (right after an upgrade or a
downgrade).

To avoid such problem, still send the old key in the old format, and
introduce a new key for the new format. The new format carries the
name servers as a string list, and can encode encrypted DNS servers.
2025-01-07 15:41:45 +01:00
Beniamino Galvani
4c7f1857df initrd-generator: add support for the "rd.net.dns" command line option
Introduce a new kernel command line option named "rd.net.dns" that can
be used to specify a global name server. It accepts name server in a
URI-like form, as for example:

  rd.net.dns=dns+tls://[fd01::1]:5353#mydomain.com
2025-01-07 15:41:44 +01:00
Beniamino Galvani
4422b14704 core, libnm: support per-connection DNS URIs
Accept name servers with a URI syntax in the ipv4.dns and ipv6.dns
properties; and accept them everywhere else in the core and libnm.
2025-01-07 15:41:44 +01:00
Beniamino Galvani
8416a58e26 core: accept DNS URIs in global configuration
Accept name servers specified with an URI syntax in the global
configuration. A plugin that doesn't support a specific scheme can
decide to ignore it and use only the servers it understands. At the
moment there is no plugin that supports DNS-over-TLS servers in the
global configuration.
2025-01-07 15:41:43 +01:00
Beniamino Galvani
4dee109b8d libnm-core: add new functions for DNS parsing
Introduce new functions to parse and normalize name servers. Their
name contains "dns_uri" because they also support a URI-like syntax
as: "dns+tls://192.0.2.0:553#example.org".
2025-01-07 15:41:43 +01:00
Beniamino Galvani
28668f8698 core: simplify nm_l3_config_data_add_nameserver_detail()
Remove unused "server_name" argument. It is still possible to pass the
server name, if needed, with the nm_l3_config_data_add_nameserver()
function. After this change, rename the function to
nm_l3_config_data_add_nameserver_addr(), since the function only
accepts an address.
2025-01-07 15:41:43 +01:00
Wen Liang
85484ab2d3 merge: branch 'wl/vpn_routing_rules'
vpn: fix routing rules support in vpn conenctions

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2092
2025-01-07 14:23:42 +00:00
Wen Liang
308e34a501 vpn: fix routing rules support in vpn conenctions
This commit introduces the ability to manage routing rules specifically
for VPN connections. These rules allow finer control over traffic
routing by enabling the specification of policy-based routing for
traffic over the VPN.

- Updated the connection backend to apply rules during VPN activation.
- Ensured proper cleanup of routing rules upon VPN deactivation.

This enhancement improves VPN usability in scenarios requiring advanced
routing configurations, such as split tunneling and traffic
prioritization.

Resolves: https://issues.redhat.com/browse/RHEL-70160
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2092
https://gitlab.freedesktop.org/NetworkManager/NetworkManager-ci/-/merge_requests/1842
2025-01-07 08:57:11 -05:00
eaglegai
9c42177d09 mptcp: fix error handling rp_filter when kernel don't support mptcp
When the kernel don't support mptcp, NetworkManager should disable mptcp
and shouldn't change rp_filter from 1 to 2. However, when checking file
/proc/sys/net/mptcp/enabled, val v's type is defined to guint32, and
nm_platform_sysctl_get_int32 return -1, v becomes a very large number
and can't set mptcp_flags to NM_MPTCP_FLAGS_DISABLED.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1686
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2093

Fixes: c00873e08f ('mptcp: rework "connection.mptcp-flags" for enabling MPTCP')
2025-01-07 11:20:16 +01:00
Íñigo Huguet
83d99669f5 distros_support.py: always put CentOS Stream at least as Tier 3
We only add to Tier 3 distro versions that ship a version of NM equal or
older to the one that we are testing. As CentOS Stream uses "main", no
stable version will be tested on it.

Force to test CentOS Stream as Tier 3.
2024-12-24 14:42:45 +01:00
Íñigo Huguet
74dba128e9 distros_support.py: fix printing "fedora" entry without "versions" 2024-12-24 14:42:09 +01:00
Íñigo Huguet
af623592f8 ci: update distros
Remove EOL'd, add new versions recently released.
2024-12-24 14:04:54 +01:00
Íñigo Huguet
5c62286a77 release, find-backports: formatting and log small fixes 2024-12-23 12:41:34 +01:00
Íñigo Huguet
248addcc22 find-backports: fix Ignore-Fixes detection
The regex for "Fixes" also matches with "Ignore-Fixes", so the commit is
added twice and then removed only once by the "Ignore-Fixes". It still
remains once in the list of commits to backport, making that
"Ignore-Fixes" does not work. Fix it.
2024-12-23 12:32:13 +01:00
Íñigo Huguet
3caf7178b9 release.sh: check the right pipelines
Now we are using scheduled pipelines for various purposes like
regenerating the container images and triage the issues and MRs. That
means that the last pipeline ran for main might not be the pipeline with
the jobs building and testing the code.

Use `source=push` to retrieve only pipelines that are not scheduled.
2024-12-23 12:32:13 +01:00
Íñigo Huguet
88b7cf0f28 release: fix help text
The help text is read from the comments at the top of the script itself.
However, to detect what lines belongs to the help text, a range was
defined as:
- Start: any line starting with `# `
- End: any line starting `# Run with --no-test`

If any later line starts with `# ` is considered as a new matching
range, and from it to the end of the file is printed too.

Fix it by defining the range:
- Start: line 2
- End: blank line
2024-12-23 12:32:13 +01:00
Íñigo Huguet
b5ef0c917e release: bump version to 1.51.5 (development) 2024-12-23 09:44:22 +01:00
Íñigo Huguet
fdf1a9fb1e libnm: use nm_strndup_a instead of strndupa
Alpine doesn't have strndupa.

Fixes: 38d1bcee3b ('ip: configurable address pool and lease time of DHCP server in shared mode')
2024-12-20 20:25:14 +01:00
Íñigo Huguet
a1b44d1958 merge: branch 'ih/release-freedesktop'
release.sh: release to freedesktop.org, not to GNOME

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2091
2024-12-20 15:33:58 +00:00
Íñigo Huguet
f05192ada8 release.sh: release to freedesktop.org, not to GNOME
GNOME has changed the process to publish releases to download.gnome.org.
Now, it is required to do it from the CI of projects hosted in GNOME's
repositories.

As we don't have the project hosted there, we have 2 options:
- Create a mirror and set up the CI so we continue using
  download.gnome.org.
- Stop publishing the tarballs there and do it in gitlab.freedesktop.org
  from now on.

After a brief discussion we have decided that the second makes more
sense, so adapt release.sh to do that.

https://discourse.gnome.org/t/gnome-release-service-ftpadmin-replacement-coming-11th-december/25487
https://handbook.gnome.org/maintainers/making-a-release.html
2024-12-20 15:33:29 +00:00
Íñigo Huguet
45dad85911 CONTRIBUTING: fix typo
Fixes https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1676
2024-12-20 16:26:00 +01:00
Fernando Fernandez Mancera
460f0b4bc9 merge: branch 'ff/garp_bond_slb'
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2057
2024-12-18 15:47:43 +01:00
Fernando Fernandez Mancera
3f2f922dd9 bonding: send ARP announcement on bonding-slb link/carrier down
When a bond in balance-slb is created, the ports are enabled or disabled
based on carrier and link state. If the link/carrier goes down, the port
becomes disabled and we must make sure the MAC tables of the switches
are updated properly so the traffic is redirected.

In order to solve this, we send a GARP or RARP broadcast packet on the
bond. This fix cover 3 different balance-slb scenarios.

Scenario 1: The bond in balance-slb mode has IPv4 address configured and
some ports connected. Here the bond is acting like active-backup as the
packets will always have as source MAC the address of the bond
interface. When a port goes down, NetworkManager will send a GARP
broadcast announcing the address configured on the bond with the MAC
address configured on the port.

Scenario 2: The bond in balance-slb mode is connected to a bridge and has
some ports connected. The bridge has IPv4 configured. When a port goes
down, NetworkManager will send a GARP broadcast announcing the address
configured on the bridge with the MAC address configured on the port.

Scenario 3: The bond in balance-slb mode is connected to a bridge and
has some ports connected. The bridge does not have IP configuration and
therefore everything is L2. When a port goes down, NetworkManager will
query the FDB table and filter the entries by the ones belonging to the
bridge and the bond ifindexes. Then, it will send a RARP broadcast
announcing every learned MAC address from FDB.

Fixes: e9268e3924 ('firewall: add mlag firewall utils for multi chassis link aggregation (MLAG) for bonding-slb')
2024-12-18 14:45:54 +01:00
Fernando Fernandez Mancera
00f47efcb2 linux-platform: add helper function to query FDB table
The function introduced queries the FDB table via netlink socket. It
accepts a list of ifindexes to filter out the FDB content not related to
it. It returns an array of MAC addresses.

To cltarify this function is unusually exposed directly on
nm-linux-platform.h as we don't want this be part of the whole
NMPlatform object or cache. This, is an exception to the rule to
simplify the integration of this functionality on NetworkManager.

In addition, it also doesn't use the async mechanism that is widely used
on netlink communication across nm-linux-platform. Again, the reason is
to simplify its use, as async communication won't provide a benefit to
the use cases we have planned for this, i.e balance-slb RARP announcing.
2024-12-18 14:45:54 +01:00
Fernando Fernandez Mancera
a63eec924c glib-aux: add nm_ether_addr_hash() helper
Add a hash generation helper for NMEtherAddr struct. This can be used
for HashTables containing pointers to NMEtherAddr structs.
2024-12-18 14:45:54 +01:00
Fernando Fernandez Mancera
69f3493670 l3cfg: add helper function to fetch all the IPv4 configured addresses
This function would be useful when performing operations related to the
IPv4 addresses configured on the l3cfg. E.g this function will be used
for getting the IPv4 to announce on a GARP on bonding-slb when one of
the ports failover.
2024-12-18 14:45:54 +01:00
Beniamino Galvani
aa91d64606 merge: branch 'wwan-mm-ipv6-default'
wwan: enable ipv6 by default in ModemManager backend

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1967
2024-12-18 13:28:30 +00:00
Richard Acayan
def6c987c8 wwan: enable ipv6 by default in ModemManager backend
In the original addition of the ModemManager backend for mobile
broadband, IPv6 was set to be disabled/ignored by default. The original
motivation for this is not obvious, but it should be gone after 11
years. Some carriers have IPv6-only networks for which the default
IPv4-only connection attempt is inappropriate. Enable IPv6 by default to
support more WWAN networks without special configuration.

Changing the default does not affect IPv4-only support thanks to
fallbacks implemented in nm_modem_get_connection_ip_type().

Link: https://gitlab.com/postmarketOS/pmaports/-/issues/2752
Fixes: a9032724cb ('modem-manager: new `NMModemBroadband'')
2024-12-18 12:58:50 +00:00
Gris Ge
c60dd5c9e0 merge: branch 'protect_vpn'
vpn: Place gateway route to table defined in ipvx.route-table

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2085
2024-12-17 08:47:49 +00:00
Gris Ge
6d06286f1d vpn: Place gateway route to table defined in ipvx.route-table
Previously, NM create direct route to gateway to main(254) route table
regardless `ipvx.route-table` value.

Fixed by setting `NMPlatformIP4Route.table_any` to `TRUE`.

Resolves: https://issues.redhat.com/browse/RHEL-69901

Signed-off-by: Gris Ge <fge@redhat.com>
2024-12-12 19:39:41 +08:00
Íñigo Huguet
3bcbe6ed01 merge: branch 'ih/rt-leftover'
l3cfg: remove routes added by NM on reapply

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2080
2024-12-11 15:55:40 +00:00
Íñigo Huguet
c06d130c38 l3cfg: get routes to prune from the list of routes configured by NM
We always sync routes in the main table, but routes in tables other
than main are only pruned if were added by NM, by default. Get the list
of routes to prune from other tables using obj_state->os_nm_configured,
as this tracks what routes were effectively added by NM.

The list should be the same that the one obtained from l3cfg_old. It
could be different if we commited the l3cfg with an NMIPRouteTableSyncMode
of NM_IP_ROUTE_TABLE_SYNC_MODE_MAIN, thus not deleting some routes at
commit time. However, since the previous commit, we never do it.

What all this shows is that starting to use different NMIPRouteTableSyncModes
is probably a bad idea: it will be a source of bugs of routes not being
always synced as users expect, and the use case for them is still to be
known.
2024-12-11 15:52:09 +00:00
Íñigo Huguet
e330eb9c4a l3cfg: remove routes added by NM on reapply
By default, on reapply we were only syncing the main routes table. This
causes that routes added by NM to other tables are not removed on
reapply. This was done to preserve routes added externally, but routes
added by NM itself should be removed.

Add a new route table syncing mode "main + NM routes". This mode
maintains the normal behaviour of syncing completely the main table,
and for other tables removes only routes that were added by us, leaving
the rest untouched. Use this mode by default, as this is what a user
would expect on reapply.

Note: this might not work if NM is restarted between the profile being
modified and the reapply, because NM forgets what routes were added by
itself because of the restart. This is a rare corner case, though.

Use the D-Bus property "VersionInfo" to expose a capability flag
indicating that this bug is fixed. It is the first capability that we
expose in this way. However, it is convenient to do it this way as it's
something that clients like nmstate needs to know, so they can decide
whether a conn down is needed or not. It is not enough to decide that by
version number because it might be fixed via a downstream patch in distros
like RHEL.

https://issues.redhat.com/browse/RHEL-67324
https://issues.redhat.com/browse/RHEL-66262

Fixes: e9c17fcc9b ('l3cfg: default to 'main' route table sync mode')
2024-12-11 15:52:09 +00:00
Íñigo Huguet
e1840ad5fb platform: rename NM_IP_ROUTE_TABLE_SYNC_MODE_FULL -> ALL_EXCEPT_LOCAL
The difference between FULL and ALL was not obvious without reading the
documentation. Moreover, a new mode is going to be introduced so the
confusion could grow. Rename to a more explicit name.
2024-12-11 15:52:09 +00:00
Íñigo Huguet
5a65170b49 libnmc: fix bug checking VersionInfo's capabilities
Remove the `+ 31u` that was making that it would search for bit 1 at
array's element 1, instead of element 0. Fixed comparison >len that
shoudl be >=len. Fix a few typos.

Fixes: bc6098d441 ('libnm: add internal nmc_client_has_{version_info_v,version_info_capability,capability}() helper')
2024-12-11 15:52:09 +00:00
Roman Pavelka
38d1bcee3b ip: configurable address pool and lease time of DHCP server in shared mode
Introduce a new options to NMSettingIpConfig. When set, ipv4.shared-dhcp-range
and ipv4.shared-dhcp-lease-time can be passed to dnsmasq to allow configuration
of DHCP server address pool range and lease time.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/941
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2028
2024-12-11 09:20:15 +01:00