Requires HAL 0.5.12 as of 2008-11-19 and kernel 2.6.27 or later; if
any dynamic killswitches are found, polled killswitches are ignored.
This is half the fix; the other half is to do something intelligent
with the rfkill state instead of taking the wifi devices down.
Not actually needed, and actually makes securing the daemon harder
from a D-Bus perspective, since both bus names resolve to the same
unique name anyway, and the unique name is what actually gets
matched on inside dbus. Suggestion from Colin Walters.
Since NM is really only a client of the provider's PPP server, and since NM
doesn't have any authentication information to authenticate the remote
peer anyway. Some providers don't set up their servers to allow clients to
ask for authentication from the remote peer either.
Based on patches by Johan Bilien <jobi@via.ecp.fr>,
nick loeve <trickie@gmail.com>, and Roy Marples <roy@marples.name>
with significant changes for dhclient formatting and test cases.
Note that dhclient needs help before it can actually parse
classless static routes by adding the following to the
dhclient.conf file:
option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
Don't do anything with WINS servers (dispatcher scripts installed with
samba could certainly update samba's idea of WINS servers), but at least
provide them so that the VPNs that can get upstream WINS servers can
at least make other stuff aware of them.
* libnm-util/libnm-util.ver
libnm-util/nm-setting-ip4-config.c
libnm-util/nm-setting-ip4-config.h
- Add 'never-default' property, which when true indicates that a
connection should never be the default connection
* src/nm-ip4-config.c
src/nm-ip4-config.h
- (nm_ip4_config_get_never_default, nm_ip4_config_set_never_default):
Add never-default helpers
* src/NetworkManagerUtils.c
- (nm_utils_merge_ip4_config): update never-default when merging the
IP4 setting to the IP4 config
* src/NetworkManagerSystem.c
- (nm_system_apply_ip4_config): if the connection is never-default,
don't add routes without a gateway
* src/NetworkManagerPolicy.c
- (get_best_device): don't let never-default connections be the best
- (update_routing_and_dns): handle never-default for VPN connections
* system-settings/plugins/ifcfg-rh/reader.c
- (make_ip4_setting): handle never-default by checking GATEWAYDEV
git-svn-id: http://svn-archive.gnome.org/svn/NetworkManager/branches/NETWORKMANAGER_0_7@4378 4912f4e0-d625-0410-9fb7-b9a5a253dbdc
* src/vpn-manager/nm-vpn-connection.c
- (plugin_state_changed): clear secrets before setting the connection
state to FAILED, since doing so may destroy the connection itself,
since the NMVPNService owning this NMVPNConnection will unref it
when the NMVPNConnection is failed or stopped
git-svn-id: http://svn-archive.gnome.org/svn/NetworkManager/branches/NETWORKMANAGER_0_7@4374 4912f4e0-d625-0410-9fb7-b9a5a253dbdc
Patch from Tambet Ingo <tambet@gmail.com>
Fix mishandling of netlink error floods (rh #459205, novell #443429, lp #284507)
* src/nm-netlink-monitor.c
- Remove bits for using a non-default GMainContext, which weren't used
- (nm_netlink_monitor_error_handler): don't leak the GError, and report
the actual error code
* src/NetworkManager.c
- (nm_error_monitoring_device_link_state): disconnect error handler when
an error flood occurs to avoid pegging the CPU
git-svn-id: http://svn-archive.gnome.org/svn/NetworkManager/trunk@4334 4912f4e0-d625-0410-9fb7-b9a5a253dbdc
Patch from Tambet Ingo <tambet@gmail.com>
* configure.in
libnm-util/libnm-util.ver
libnm-util/nm-setting-8021x.c
libnm-util/nm-setting-8021x.h
- Add configure-time option for the system CA path
- Add 'system-ca-certs' option to 802.1x setting, which directs
NetworkManager to use system CA certificates instead of any
connection-defined CA certificates
* src/supplicant-manager/nm-supplicant-config.c
src/supplicant-manager/nm-supplicant-settings-verify.c
- Use system CA certificates if the connection says to do so
git-svn-id: http://svn-archive.gnome.org/svn/NetworkManager/trunk@4326 4912f4e0-d625-0410-9fb7-b9a5a253dbdc
* src/nm-dbus-manager.c
src/nm-dbus-manager.h
- (nm_dbus_manager_get_name_owner): return error
* src/nm-manager.c
- (impl_manager_activate_connection): perform additional validation on
ActivateConnection calls of user connections
- (is_user_request_authorized): ensure that the requestor is the same
UID as the UID that owns the user settings service; users shouldn't
be able to control another user's connections
git-svn-id: http://svn-archive.gnome.org/svn/NetworkManager/trunk@4325 4912f4e0-d625-0410-9fb7-b9a5a253dbdc
Handle gateways on different subnets
* src/NetworkManagerSystem.c
- (add_ip4_route_to_gateway): gateway route should be link scope and
a host route
- (replace_default_ip4_route): use a destination address too; gateway
address should be /0; don't leak the gateway route object
git-svn-id: http://svn-archive.gnome.org/svn/NetworkManager/trunk@4290 4912f4e0-d625-0410-9fb7-b9a5a253dbdc
* vpn-manager/nm-vpn-connection.c
- (plugin_state_changed): clear VPN secrets on error to ensure they
are always requested from the settings service (rh #429287)
git-svn-id: http://svn-archive.gnome.org/svn/NetworkManager/trunk@4282 4912f4e0-d625-0410-9fb7-b9a5a253dbdc
Add support for PKCS#12 private keys (bgo #558982)
* libnm-util/crypto.c
libnm-util/crypto.h
- (parse_old_openssl_key_file): rename from parse_key_file(); adapt to
take a GByteArray instead of a filename
- (file_to_g_byte_array): handle private key files too
- (decrypt_key): take a GByteArray rather than data + len
- (crypto_get_private_key_data): refactor crypto_get_private_key() into
one function that takes a filename, and one that takes raw data;
detect pkcs#12 files as well
- (crypto_load_and_verify_certificate): detect file type
- (crypto_is_pkcs12_data, crypto_is_pkcs12_file): add pkcs#12 detection
functions
* libnm-util/crypto_gnutls.c
- (crypto_decrypt): take GByteArray rather than data + len; fix a bug
whereby tail padding was incorrectly handled, leading to erroneous
successes when trying to decrypt the data
- (crypto_verify_cert): rework somewhat
- (crypto_verify_pkcs12): validate pkcs#12 keys
* libnm-util/crypto_nss.c
- (crypto_init): enable various pkcs#12 ciphers
- (crypto_decrypt): take a GByteArray rather than data + len
- (crypto_verify_cert): clean up
- (crypto_verify_pkcs12): validate pkcs#12 keys
* libnm-util/test-crypto.c
- Handle pkcs#12 keys
* libnm-util/nm-setting-8021x.c
libnm-util/nm-setting-8021x.h
libnm-util/libnm-util.ver
- Add two new properties, 'private-key-password' and
'phase2-private-key-password', to be used in conjunction with
pkcs#12 keys
- (nm_setting_802_1x_set_ca_cert_from_file,
nm_setting_802_1x_set_client_cert_from_file,
nm_setting_802_1x_set_phase2_ca_cert_from_file,
nm_setting_802_1x_set_phase2_client_from_file): return certificate
type
- (nm_setting_802_1x_get_private_key_password,
nm_setting_802_1x_get_phase2_private_key_password): return private
key passwords
- (nm_setting_802_1x_set_private_key_from_file,
nm_setting_802_1x_set_phase2_private_key_from_file): set the private
key from a file, and update the private key password at the same time
- (nm_setting_802_1x_get_private_key_type,
nm_setting_802_1x_get_phase2_private_key_type): return the private
key type
* src/supplicant-manager/nm-supplicant-settings-verify.c
- Whitelist private key passwords
* src/supplicant-manager/nm-supplicant-config.c
- (nm_supplicant_config_add_setting_8021x): for pkcs#12 private keys,
add the private key password to the supplicant config, but do not
add the client certificate (as required by wpa_supplicant)
git-svn-id: http://svn-archive.gnome.org/svn/NetworkManager/trunk@4280 4912f4e0-d625-0410-9fb7-b9a5a253dbdc
Fix deletion of VPN gateway route on DHCP renew (bgo #558133)
* src/NetworkManagerSystem.c
src/NetworkManagerSystem.h
- (nm_system_device_set_ip4_route): return the route that was added
- (nm_system_add_ip4_vpn_gateway_route): make add_vpn_gateway_route()
public, clean up, and return the route that was added
- (nm_system_apply_ip4_config): remove VPN related stuff to simplify,
since nm_system_add_ip4_vpn_gateway_route() is now available; add
flags to allow only certain attributes of the NMIP4Config to be
applied
* src/nm-device.c
- (handle_dhcp_lease_change): don't touch the DHCP4 config on failure
- (nm_device_set_ip4_config): use nm_ip4_config_diff() to only apply
what's really changed between the old and new configs; don't export
the new IP4 config on failure; always send the DNS info to the
named manager
* src/vpn-manager/nm-vpn-connection.c
- (device_ip4_config_changed, nm_vpn_connection_new, dispose): track the
parent device's IP4Config and re-add the VPN gateway route when it
changes
- (nm_vpn_connection_ip4_config_get): add the VPN gateway route (since
nm_system_apply_ip4_config() no longer does) and cache it for later
- (connection_state_changed): move cleanup code to its own function
- (vpn_cleanup): delete any previously added VPN gateway route; and
re-apply the parent device's addresses and routes using
nm_system_apply_ip4_config(), not nm_device_set_ip4_config()
git-svn-id: http://svn-archive.gnome.org/svn/NetworkManager/trunk@4277 4912f4e0-d625-0410-9fb7-b9a5a253dbdc
* src/nm-ip4-config.c
src/nm-ip4-config.h
- (nm_ip4_config_diff): new function; return the difference between two
IP4 configs
- (nm_ip4_config_compare): change into nm_ip4_config_diff
git-svn-id: http://svn-archive.gnome.org/svn/NetworkManager/trunk@4275 4912f4e0-d625-0410-9fb7-b9a5a253dbdc
