On Fedora rawhide we get the following build failure:

    In file included from shared/systemd/src/basic/alloc-util.c:3:
    ./shared/systemd/sd-adapt-shared/nm-sd-adapt-shared.h:114:21: error: static declaration of 'gettid' follows non-static declaration
      114 | static inline pid_t gettid(void) {
          |                     ^~~~~~
    In file included from /usr/include/unistd.h:1170,
                     from /usr/include/glib-2.0/gio/gcredentials.h:32,
                     from /usr/include/glib-2.0/gio/gio.h:46,
                     from ./shared/nm-utils/nm-macros-internal.h:31,
                     from ./shared/nm-default.h:293,
                     from ./shared/systemd/sd-adapt-shared/nm-sd-adapt-shared.h:22,
                     from shared/systemd/src/basic/alloc-util.c:3:
    /usr/include/bits/unistd_ext.h:34:16: note: previous declaration of 'gettid' was here
       34 | extern __pid_t gettid (void) __THROW;
          |                ^~~~~~

glibc supports now gettid() call ([1]) which conflicts with our compat
implementation. Rename it.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=1d0fc213824eaa2a8f8c4385daaa698ee8fb7c92

(cherry picked from commit 10276322)
(cherry picked from commit cfb970b2)
(cherry picked from commit d160b7b9)
(cherry picked from commit b10a7e57)

4 properties are not really relevant for an already activated connection
or it makes not sense to change them. These are connection.id, connection.uuid,
connection.autoconnect and connection.stable-id.

For convenience, we allow to reapply these. This way, one can take
a different setting (e.g. with a different connection.id or
connection.uuid) and reapply them, but such changes are silently
ignored.

However this was done wrongly. Instead of reverting the change to the new
applied connection, we would change the input connection.

This is bad, for example with

  nmcli connection up uuid cb922f18-e99a-49c6-b200-1678b5070a82
  nmcli connection modify cb922f18-e99a-49c6-b200-1678b5070a82 con-name "bogus"
  nmcli device reapply eth0

the last re-apply would reset the settings-connection's connection ID to
what was before, while accepting the new name on the applied-connection
(while it should have been rejected).

Fixes: bf3b3d44 ('device: avoid changing immutable properties during reapply')

(cherry picked from commit adb51c2a)
(cherry picked from commit 09f37d5b)
(cherry picked from commit 9c72ca5e)
(cherry picked from commit b1209e37)
(cherry picked from commit cacb80e5)

https://bugzilla.redhat.com/show_bug.cgi?id=1727193

Fixes: 433d2f86 ('core: merge IPv4 and IPv6 version of _nm_ip_config_merge_route_attributes()')
(cherry picked from commit a8fa015a)
(cherry picked from commit 44e4ed1e)
(cherry picked from commit d3b7b0d2)
(cherry picked from commit 8f85b6a3)
(cherry picked from commit ccd8afb4)

Beniamino Galvani authored Aug 02, 2018 and Thomas Haller committed Feb 20, 2019

When NM has to rebuild the platform cache, it first generates ADD and
then REMOVE events for the links.  So, if an interface is removed and
readded, platform will emit the ADDED event with a new ifindex while
the device with old ifindex still exists.

In such case the manager currently updates the device's ifindex but
this causes problems as the DNS manager tracks configurations by their
ifindex and so the configurations for the old device will become
stale.

Fix this by removing the device and adding it again when we detect a
change of ifindex on a device that already had valid one.

https://bugzilla.redhat.com/show_bug.cgi?id=1542366
(cherry picked from commit 281974b9)
(cherry picked from commit 17a89f70)

Beniamino Galvani authored Aug 03, 2018 and Thomas Haller committed Feb 20, 2019

If the device is later realized again, we assert that there aren't any
IP config changes queued. Therefore, they must be cleared on
unrealize().

(cherry picked from commit 9ed07fbb)
(cherry picked from commit fb83d623)

Fixes: 337304f1
(cherry picked from commit 41ea9fff)
(cherry picked from commit 38890376)
(cherry picked from commit be2da47a)

Since we determine the connectivity state of each device individually,
the global connectivity state is an aggregate of all these states.

I am not sure about considering here devices that don't have the (best)
default route for their respective address family. But anyway.

When we aggregate the best connectivity, we chose the numerical largest
value. That is wrong, because PORTAL is numerically smaller than
LIMITED.

That means, if you have two devices, one with connectivity LIMITED and
one with connectivity PORTAL, then LIMITED wrongly wins.

Fixes: 6b7e9f9b

https://bugzilla.redhat.com/show_bug.cgi?id=1619873
(cherry picked from commit ade753d0)
(cherry picked from commit d1e98e33)
(cherry picked from commit 18103b00)

(cherry picked from commit 487ee687)
(cherry picked from commit 51b7b10d)
(cherry picked from commit c155f776)

Thomas Haller authored Aug 10, 2018 and Beniamino Galvani committed Nov 30, 2018

Seems this assertion still can fail. Dunno, maybe the timeout was just too
short. Increase it.

(cherry picked from commit b7bdde6e)
(cherry picked from commit 4909ea71)

Thomas Haller authored Jun 20, 2018 and Beniamino Galvani committed Nov 30, 2018

Otherwise, we easily get a failure

    test:ERROR:src/platform/tests/test-cleanup.c:78:test_cleanup_internal: assertion failed (addresses6->len == 2): (1 == 2)

Avoid that by waiting for kernel to add the link-local
address.

(cherry picked from commit fb63d8d7)
(cherry picked from commit b6ff26fb)

Thomas Haller authored Jun 20, 2018 and Beniamino Galvani committed Nov 30, 2018

Inside the loop-handler, it can be interesting to know the current iteration,
and how much time is left.

(cherry picked from commit 86dc1f13)
(cherry picked from commit 945f51d6)

Thomas Haller authored Jun 20, 2018 and Beniamino Galvani committed Nov 30, 2018

(cherry picked from commit 07a34f24)
(cherry picked from commit 4ca06404)

Fixes: c8fa7b6f

(cherry picked from commit 803514df)
(cherry picked from commit 047747f9)
(cherry picked from commit 8708da11)

Sometimes the test fail:

    $ make -j 10 src/platform/tests/test-address-linux
    $ while true; do
          NMTST_DEBUG=d ./tools/run-nm-test.sh src/platform/tests/test-address-linux 2>&1 > log.txt || break;
      done

fails with:

    ERROR: src/platform/tests/test-address-linux - Bail out! test:ERROR:src/platform/tests/test-common.c:790:nmtstp_ip_address_assert_lifetime: assertion failed (adr <= lft): (1001 <= 1000)

That is, because of a wrong check. Fix it.

(cherry picked from commit e180464b)
(cherry picked from commit 66cbca1f)
(cherry picked from commit 7820d71e)

Patrick Talbert authored Nov 23, 2018 and Thomas Haller committed Nov 23, 2018

This makes the output of a 'con show' for a team device look suspect.

Signed-off-by: Patrick Talbert <ptalbert@redhat.com>

Fixes: 4657390d

!53
(cherry picked from commit 25a07396)
(cherry picked from commit e28bfa41)
(cherry picked from commit 3444c114)

Beniamino Galvani authored Aug 31, 2018 and Thomas Haller committed Nov 22, 2018

After an update of the connection.mdns property, a reactivation is
needed to apply the new value.

Also, the ifcfg-rh variable name was wrong.

Fixes: 2e2ff6f2
(cherry picked from commit 8e6ad285)
(cherry picked from commit b5468828)

We used to read 3 bytes after the TLV, fix this.

Also, check that string length is at most 32 bytes as specified in
figure E.3 of IEEE 802.1AB-2009.

Fixes: 18133ea1

https://bugzilla.redhat.com/show_bug.cgi?id=1652210
(cherry picked from commit e9097787)
(cherry picked from commit 05c27c3c)
(cherry picked from commit 6d4ad477)

Lubomir Rintel authored Oct 22, 2018 and Thomas Haller committed Nov 22, 2018

Fixed build with clang:

  src/ndisc/nm-lndp-ndisc.c:494:27: error: unused variable 'ndisc_keep_alive' [-Werror,-Wunused-variable]
        gs_unref_object NMNDisc *ndisc_keep_alive = g_object_ref (ndisc);
                                 ^
Fixes: 9aa628ce

(cherry picked from commit 7c7e4cf1)
(cherry picked from commit 506f7814)
(cherry picked from commit 77234c35)

Beniamino Galvani authored Jun 29, 2018 and Thomas Haller committed Nov 22, 2018

Fixes: 17009ed9
(cherry picked from commit db1867ba)
(cherry picked from commit 5ccd7f7f)

Beniamino Galvani authored Apr 16, 2018 and Thomas Haller committed Nov 22, 2018

Fixes: 902bbfdb
(cherry picked from commit 805cbe74)

Benjamin Berg authored Nov 15, 2018 and Thomas Haller committed Nov 15, 2018

In certain cases the timeouts may not have been unref'ed before they
need to be re-added. Add the appropriate unref calls to ensure we don't
register the timeout multiple times.

This fixes possible cases where timeouts are triggered multiple times
and even on destroyed DHCPv6 clients.

#73

(cherry picked from commit e179202e)
(cherry picked from commit bbef6cf4)
(cherry picked from commit d535f95b)

Corentin Noël authored Nov 08, 2018 and Thomas Haller committed Nov 12, 2018

The GPtrArray owns the element so it is a (transfer full).

!46
(cherry picked from commit 201c153e)
(cherry picked from commit 7d5cce2e)
(cherry picked from commit 000c8059)

Lennart Poettering authored Oct 19, 2018 and Thomas Haller committed Oct 29, 2018

Fixes a vulnerability originally discovered by Felix Wilhelm from
Google.

CVE-2018-15688
LP: #1795921
https://bugzilla.redhat.com/show_bug.cgi?id=1639067

(cherry picked from commit 4dac5eaba4e419b29c97da38a8b1f82336c2c892)
(cherry picked from commit 01ca2053)
(cherry picked from commit fc230dca)
(cherry picked from commit cc1e5a7f)

Li Song authored Oct 19, 2018 and Thomas Haller committed Oct 29, 2018

(cherry picked from commit cc3981b1272b9ce37e7d734a7b2f42e84acac535)
(cherry picked from commit 915c2f67)
(cherry picked from commit cb77290a)
(cherry picked from commit f211b140)

Yu Watanabe authored Oct 19, 2018 and Thomas Haller committed Oct 29, 2018

This improves performance of fuzzer.
C.f. oss-fuzz#11019.

(cherry picked from commit 3c72b6ed4252e7ff5f7704bfe44557ec197b47fa)
(cherry picked from commit 50403ccc)
(cherry picked from commit f11f5abb)
(cherry picked from commit c836279f)

Yu Watanabe authored Sep 27, 2018 and Thomas Haller committed Oct 29, 2018

(cherry picked from commit e2975f854831d08a25b4f5eb329b6d04102e115f)
(cherry picked from commit 157094ab)
(cherry picked from commit 3fd9d116)

Evgeny Vereshchagin authored Sep 29, 2018 and Thomas Haller committed Oct 29, 2018

==14==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200055fa9c at pc 0x0000005458f1 bp 0x7ffc78940d90 sp 0x7ffc78940d88
READ of size 1 at 0x60200055fa9c thread T0
    #0 0x5458f0 in dhcp6_option_parse_domainname /work/build/../../src/systemd/src/libsystemd-network/dhcp6-option.c:555:29
    #1 0x54706e in dhcp6_lease_set_domains /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-lease.c:242:13
    #2 0x53fce0 in client_parse_message /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-client.c:984:29
    #3 0x53f3bc in client_receive_advertise /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-client.c:1083:13
    #4 0x53d57f in client_receive_message /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-client.c:1182:21
    #5 0x7f0f7159deee in source_dispatch /work/build/../../src/systemd/src/libsystemd/sd-event/sd-event.c:3042:21
    #6 0x7f0f7159d431 in sd_event_dispatch /work/build/../../src/systemd/src/libsystemd/sd-event/sd-event.c:3455:21
    #7 0x7f0f7159ea8d in sd_event_run /work/build/../../src/systemd/src/libsystemd/sd-event/sd-event.c:3512:21
    #8 0x531f2b in fuzz_client /work/build/../../src/systemd/src/fuzz/fuzz-dhcp6-client.c:44:9
    #9 0x531bc1 in LLVMFuzzerTestOneInput /work/build/../../src/systemd/src/fuzz/fuzz-dhcp6-client.c:53:9
    #10 0x57bec8 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:570:15
    #11 0x579d67 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/libfuzzer/FuzzerLoop.cpp:479:3
    #12 0x57dc92 in fuzzer::Fuzzer::MutateAndTestOne() /src/libfuzzer/FuzzerLoop.cpp:707:19
    #13 0x580ca6 in fuzzer::Fuzzer::Loop(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /src/libfuzzer/FuzzerLoop.cpp:838:5
    #14 0x55e968 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:764:6
    #15 0x551a1c in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #16 0x7f0f701a082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #17 0x41e928 in _start (/out/fuzz-dhcp6-client+0x41e928)

https://github.com/systemd/systemd/pull/10200
https://github.com/systemd/systemd/commit/b387d3c1327a3ad2a2509bd3d3491e674392ff21
(cherry picked from commit 7cb7cffc)
(cherry picked from commit cd3aacef)
(cherry picked from commit 5b140a77)

An assertion in dhcp_network_bind_raw_socket() is triggered when
starting an sd_dhcp_client without setting setting a MAC address
first.

  - sd_dhcp_client_start()
    - client_start()
      - client_start_delayed()
        - dhcp_network_bind_raw_socket()

In that case, the arp-type and MAC address is still unset. Note that
dhcp_network_bind_raw_socket() already checks for a valid arp-type
and MAC address below, so we should just gracefully return -EINVAL.

Maybe sd_dhcp_client_start() should fail earlier when starting without
MAC address. But the failure here will be correctly propagated and
the start aborted.

See-also: https://github.com/systemd/systemd/pull/10054
(cherry picked from commit 34af574d)
(cherry picked from commit 0a797bdc)
(cherry picked from commit f37ed84c)

We must disconnect ActivateInfo before invoking callbacks.

Otherwise, it can happen that the callee cancels the cancellable,
which in turn enters activate_info_complete() again, and leads
to a crash.

https://bugzilla.redhat.com/show_bug.cgi?id=1642625
(cherry picked from commit ec37e18c)
(cherry picked from commit 2c6fafad)
(cherry picked from commit 3d23e9d6)

https://github.com/NetworkManager/NetworkManager/pull/235
https://bugzilla.gnome.org/show_bug.cgi?id=746422

Commit 9d92848a ("libnm: rename MDns flag UNKNOWN to DEFAULT")
changed the enum order without updating verify().

Fixes: 9d92848a
(cherry picked from commit 0498c548)

ip_data->domains.reverse can be NULL when the device is being removed
and has no IP configuration for a short moment.

Fixes: 6409e771

https://bugzilla.gnome.org/show_bug.cgi?id=797022
(cherry picked from commit f0c075f0)
(cherry picked from commit 8309a7a6)

https://bugzilla.gnome.org/show_bug.cgi?id=746422
(cherry picked from commit d9782589)

https://bugzilla.gnome.org/show_bug.cgi?id=746422
(cherry picked from commit b2f306ac)

(cherry picked from commit 1fbadecd)

Honor dns-priority by using the preprocessed list of domains provided
by the manager.

(cherry picked from commit 5df69330)