GitLab

Start of new development version 0.9.1; next stable release
will be 0.9.2.

Yay!

Includes subject_match and phase2_subject_match (string) parameters,
and altsubject_matches and phase2_altsubject_matches (list of string)
parameters.

subject_match is matched against a substring of the subject from the
certificate presented by the remote authentication server. If this
option is unset, no subject verification is performed.

altsubject_matches are each tested against the alternate subject name
(altSubjectName) of the certificate presented by the remote
authentication server. If this option is unset, no verification of the
altSubjectName is performed.

When new services are installed and the daemon reloads bus policy
(like when installing new VPN plugins with rpm or dpkg) it appears
the rules don't get loaded into NetworkManager's policy space.
Thus any D-Bus message NM sends to the newly installed VPN plugin
gets denied until a restart of NM or the machine.  Work around
this dbus bug by letting NM talk to all known VPN services in the
NM policy file which will always exist when NM is around.

NMRemoteSettings's constructor requires a DBusGConnection, but there
currently aren't any usable gobject-introspection bindings for that class.
This means that NMRemoteSettings can't be used over gobject-introspection.

Move the default fallback to the system bus into the constructor path, so
that introspection bindings are usable.

Python test case:
	from gi.repository import NMClient
	NMClient.RemoteSettings()

Before, this produced a segfault. Now it returns a usable RemoteSettings
object.

  ESRCH becomes NLE_OBJ_NOTFOUND. Includes workaround for libnl
  aliased return value where ESRCH is being converted to a generic
  unspecified error by libnl [1].

  [1] http://git.kernel.org/?p=libs/netlink/libnl.git;a=commit;h=7e9d5f

Once we've sent a method call over DBus requesting that the modem be
disabled, we should assume that the modem is disabled unless we hear
otherwise.  Otherwise, code that checks the modem state immediately
after it gets disabled might think that it's enabled when it almost
certainly is not.

Normally, a device disabled via nm_device_interface_set_enabled() will
shift into the UNAVAILABLE state.  Modems, however, don't do that.
Rather, they pretend that they are in the DISCONNECTED state, presumably
to make it easier to re-enable them.  To avoid accidentally re-enabling
and autoconnecting a disabled modem, we need to explicitly make
nm_device_interface_get_enabled() == true a prerequisite for
autoconnecting.

What we want to do here is keep separate caches of system and
agent secrets.  For system secrets, we cache them because NM
periodically clears secrets using nm_connection_clear_secrets() to
ensure they don't stay around in memory, and that transient secrets
get requested again when they are needed.  For agent secrets, we
only want them during activation, but a connection read from disk
will not include agent secrets becuase by definition they aren't
stored in system settings along with the connection.  Thus we need
to keep the agent/transient secrets somewhere for the duration of
the activation to ensure they don't get deleted.

This removes the copy-back hack in update_auth_cb() which copied
agent/transient secrets back into the connection over top of the
transient secrets that had been copied back in
nm_settings_connection_replace_settings().  No reason to copy
them twice if we keep an agent/transient secrets hash and do
the right thing with it.

The core problem was that the Update would trigger a write to
disk to save the connection's new settings, which called
nm_settings_connection_replace_settings().  Which saved existing
transient (agent/unsaved) secrets, replaced settings with the
new ones from Update(), then copied back the old transient
secrets.  This was to ensure that changes triggered from getting
agent secrets during activation (which might write the connection
out to disk if new system secrets were provided, which triggered
an inotify read-back of the connection, which blew away the
transient secrets just returned from the agent) didn't blow away
transient secrets.  Unfortunately that fix was too general.

As a quick hack for now, copy the new secrets and re-apply them
after nm_connection_replace_settings() has run.  We'll do the
actual fix later, but it's more involved and needs more testing
so we don't want to apply it this close to release.

Nothing in cli uses the marshalller stuff.

Lamarque wanted clarification about how it's supposed to be used.

Instead of manually which is error-prone.

Not sure if it really makes a difference, but...