New upstream version 1.58~rc1 upstream/1.58_rc1

6 files changed, 185 insertions, 4 deletions

diff --git a/src/core/tests/config/NetworkManager-warn.conf b/src/core/tests/config/NetworkManager-warn.conf
index 80df7c52..f43f4cf1 100644
--- a/src/core/tests/config/NetworkManager-warn.conf
+++ b/src/core/tests/config/NetworkManager-warn.conf
@@ -1,5 +1,5 @@
 [main]
-dhcp=dhclient
+dhcp=internal
 plugin=foo,bar,baz
 no-auto-default=11:11:11:11:11:11
 rc-managed=unmanaged
diff --git a/src/core/tests/config/NetworkManager.conf b/src/core/tests/config/NetworkManager.conf
index ae9f3e46..7584a0f2 100644
--- a/src/core/tests/config/NetworkManager.conf
+++ b/src/core/tests/config/NetworkManager.conf
@@ -1,5 +1,5 @@
 [main]
-dhcp=dhclient
+dhcp=internal
 plugins=foo,bar,baz
 no-auto-default=11:11:11:11:11:11
 
diff --git a/src/core/tests/config/test-config.c b/src/core/tests/config/test-config.c
index b2f29821..c549bcaa 100644
--- a/src/core/tests/config/test-config.c
+++ b/src/core/tests/config/test-config.c
@@ -162,7 +162,7 @@ test_config_simple(void)
     g_assert_cmpstr(nm_config_data_get_config_main_file(nm_config_get_data_orig(config)),
                     ==,
                     TEST_DIR "/NetworkManager.conf");
-    g_assert_cmpstr(_config_get_dhcp_client_a(config), ==, "dhclient");
+    g_assert_cmpstr(_config_get_dhcp_client_a(config), ==, "internal");
     g_assert_cmpstr(nm_config_get_log_level(config), ==, "INFO");
     g_assert_cmpint(nm_config_data_get_connectivity_interval(nm_config_get_data_orig(config)),
                     ==,
@@ -297,7 +297,7 @@ test_config_override(void)
     g_assert_cmpstr(nm_config_data_get_config_main_file(nm_config_get_data_orig(config)),
                     ==,
                     TEST_DIR "/NetworkManager.conf");
-    g_assert_cmpstr(_config_get_dhcp_client_a(config), ==, "dhclient");
+    g_assert_cmpstr(_config_get_dhcp_client_a(config), ==, "internal");
     g_assert_cmpstr(nm_config_get_log_level(config), ==, "INFO");
     g_assert_cmpint(nm_config_data_get_connectivity_interval(nm_config_get_data_orig(config)),
                     ==,
diff --git a/src/core/tests/test-core.c b/src/core/tests/test-core.c
index e08296c2..b8920558 100644
--- a/src/core/tests/test-core.c
+++ b/src/core/tests/test-core.c
@@ -7,6 +7,7 @@
 
 #include <net/if.h>
 #include <byteswap.h>
+#include <netinet/ip6.h>
 
 /* need math.h for isinf() and INFINITY. No need to link with -lm */
 #include <math.h>
@@ -19,6 +20,7 @@
 #include "dns/nm-dns-manager.h"
 #include "nm-connectivity.h"
 #include "nm-firewall-utils.h"
+#include "nm-l3-config-data.h"
 
 #include "nm-test-utils-core.h"
 
@@ -2770,6 +2772,104 @@ test_nm_firewall_nft_stdio_mlag(void)
        "nm-mlag-bond0\012delete table netdev nm-mlag-bond0\012");
 }
 
+static void
+test_icmp6_checksum(void)
+{
+    struct ip6_hdr ip6h = {};
+    guint8        *data;
+    guint16        c;
+
+    ip6h.ip6_src = NM_IN6ADDR_INIT(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+    ip6h.ip6_dst = NM_IN6ADDR_INIT(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+    data         = (guint8[]) {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+    c            = nm_utils_icmp6_checksum(&ip6h.ip6_src, 12, data);
+    g_assert_cmpint(c, ==, htons(0xffb9));
+
+    ip6h.ip6_src = NM_IN6ADDR_INIT(0xfe,
+                                   0x80,
+                                   0x00,
+                                   0x00,
+                                   0x00,
+                                   0x00,
+                                   0x00,
+                                   0x00,
+                                   0xc0,
+                                   0x60,
+                                   0x8c,
+                                   0xaf,
+                                   0xf6,
+                                   0x9b,
+                                   0xe4,
+                                   0x1a);
+    ip6h.ip6_dst = NM_IN6ADDR_INIT(0x20,
+                                   0x02,
+                                   0xaa,
+                                   0xaa,
+                                   0x00,
+                                   0x00,
+                                   0x00,
+                                   0x00,
+                                   0x64,
+                                   0xd4,
+                                   0x29,
+                                   0x32,
+                                   0x35,
+                                   0x85,
+                                   0x7c,
+                                   0x89);
+    data         = (guint8[]) {0xdc, 0x74, 0x1a, 0xcc, 0xd3, 0x8e, 0xca, 0x34};
+    c            = nm_utils_icmp6_checksum(&ip6h.ip6_src, 8, data);
+    g_assert_cmpint(c, ==, htons(0x39af));
+}
+
+/*****************************************************************************/
+
+static void
+test_l3_config_data_cmp_default_routes(void)
+{
+    nm_auto_unref_dedup_multi_index NMDedupMultiIndex *multi_idx = nm_dedup_multi_index_new();
+    nm_auto_unref_l3cd_init NML3ConfigData            *a         = NULL;
+    nm_auto_unref_l3cd_init NML3ConfigData            *b         = NULL;
+    const int                                          IFINDEX   = 1;
+
+    a = nm_l3_config_data_new(multi_idx, IFINDEX, NM_IP_CONFIG_SOURCE_USER);
+    nm_l3_config_data_add_route_4(
+        a,
+        NM_PLATFORM_IP4_ROUTE_INIT(.ifindex = IFINDEX,
+                                   .network = 0,
+                                   .plen    = 0,
+                                   .gateway = nmtst_inet4_from_string("192.168.1.1"),
+                                   .metric  = 100));
+
+    b = nm_l3_config_data_new(multi_idx, IFINDEX, NM_IP_CONFIG_SOURCE_USER);
+    nm_l3_config_data_add_route_4(
+        b,
+        NM_PLATFORM_IP4_ROUTE_INIT(.ifindex       = IFINDEX,
+                                   .network       = 0,
+                                   .plen          = 0,
+                                   .gateway       = nmtst_inet4_from_string("192.168.1.1"),
+                                   .metric        = 100,
+                                   .table_coerced = nm_platform_route_table_coerce(100)));
+
+    nm_l3_config_data_seal(a);
+    nm_l3_config_data_seal(b);
+
+    g_assert(nm_l3_config_data_get_best_default_route(a, AF_INET));
+    g_assert(!nm_l3_config_data_get_best_default_route(b, AF_INET));
+
+    g_assert_cmpint(nm_l3_config_data_cmp_full(a, b, NM_L3_CONFIG_CMP_FLAGS_ROUTES_ID), !=, 0);
+    g_assert_cmpint(nm_l3_config_data_cmp_full(b, a, NM_L3_CONFIG_CMP_FLAGS_ROUTES_ID), !=, 0);
+
+    g_assert_cmpint(nm_l3_config_data_cmp_full(a, b, NM_L3_CONFIG_CMP_FLAGS_ROUTES), !=, 0);
+    g_assert_cmpint(nm_l3_config_data_cmp_full(b, a, NM_L3_CONFIG_CMP_FLAGS_ROUTES), !=, 0);
+
+    g_assert_cmpint(nm_l3_config_data_cmp_full(a, b, NM_L3_CONFIG_CMP_FLAGS_ADDRESSES), ==, 0);
+    g_assert_cmpint(nm_l3_config_data_cmp_full(b, a, NM_L3_CONFIG_CMP_FLAGS_ADDRESSES), ==, 0);
+
+    g_assert_cmpint(nm_l3_config_data_cmp_full(a, a, NM_L3_CONFIG_CMP_FLAGS_ALL), ==, 0);
+    g_assert_cmpint(nm_l3_config_data_cmp_full(b, b, NM_L3_CONFIG_CMP_FLAGS_ALL), ==, 0);
+}
+
 /*****************************************************************************/
 
 NMTST_DEFINE();
@@ -2848,5 +2948,10 @@ main(int argc, char **argv)
 
     g_test_add_func("/core/test_nm_firewall_nft_stdio_mlag", test_nm_firewall_nft_stdio_mlag);
 
+    g_test_add_func("/core/general/test_icmp6_checksum", test_icmp6_checksum);
+
+    g_test_add_func("/core/general/test_l3_config_data_cmp_default_routes",
+                    test_l3_config_data_cmp_default_routes);
+
     return g_test_run();
 }
diff --git a/src/core/tests/test-netns.c b/src/core/tests/test-netns.c
index 26ecbcb8..7bcd3809 100644
--- a/src/core/tests/test-netns.c
+++ b/src/core/tests/test-netns.c
@@ -53,6 +53,44 @@ test_ip_reservation_shared4(void)
     }
 }
 
+static void
+test_ip_reservation_clat(void)
+{
+    gs_unref_object NMPlatform *platform = NULL;
+    gs_unref_object NMNetns    *netns    = NULL;
+    NMNetnsIPReservation       *res[8];
+    NMNetnsIPReservation       *res1;
+    char                        buf[NM_INET_ADDRSTRLEN];
+    guint                       i;
+
+    platform = g_object_ref(NM_PLATFORM_GET);
+    netns    = nm_netns_new(platform);
+
+    /* Allocate addresses 192.0.0.{5,6,7,0,1,2,3,4} */
+    for (i = 0; i < 8; i++) {
+        res[i] = nm_netns_ip_reservation_get(netns, NM_NETNS_IP_RESERVATION_TYPE_CLAT);
+        g_snprintf(buf, sizeof(buf), "192.0.0.%u", (i + 5) % 8);
+        nmtst_assert_ip4_address(res[i]->addr, buf);
+        g_assert_cmpint(res[i]->_ref_count, ==, 1);
+    }
+
+    /* Release an address and get it back */
+    nm_netns_ip_reservation_release(res[2]);
+    res[2] = nm_netns_ip_reservation_get(netns, NM_NETNS_IP_RESERVATION_TYPE_CLAT);
+    nmtst_assert_ip4_address(res[2]->addr, "192.0.0.7");
+
+    /* No reuse */
+    NMTST_EXPECT_NM_ERROR("netns[*]: clat: ran out of IP addresses");
+    res1 = nm_netns_ip_reservation_get(netns, NM_NETNS_IP_RESERVATION_TYPE_CLAT);
+    g_test_assert_expected_messages();
+    g_assert_null(res1);
+
+    /* Release all */
+    for (i = 0; i < 8; i++) {
+        nm_netns_ip_reservation_release(res[i]);
+    }
+}
+
 /*****************************************************************************/
 
 NMTST_DEFINE();
@@ -64,6 +102,7 @@ main(int argc, char **argv)
     nm_linux_platform_setup();
 
     g_test_add_func("/netns/ip_reservation/shared4", test_ip_reservation_shared4);
+    g_test_add_func("/netns/ip_reservation/clat", test_ip_reservation_clat);
 
     return g_test_run();
 }
diff --git a/src/core/tests/test-systemd.c b/src/core/tests/test-systemd.c
index 1b0b7f65..09481a64 100644
--- a/src/core/tests/test-systemd.c
+++ b/src/core/tests/test-systemd.c
@@ -83,6 +83,42 @@ test_sd_event(void)
 
 /*****************************************************************************/
 
+static void
+test_http_url_is_valid_https(void)
+{
+    /* CVE-2026-10805: connection.mud-url is pasted verbatim into the dhclient
+     * config inside a quoted string ("send mudurl \"%s\";"). This function
+     * gates the property at verify() time, so it must reject characters that
+     * break out of the quotes or inject config syntax. */
+#define _assert_valid(url)   g_assert(nm_sd_http_url_is_valid_https("" url))
+#define _assert_invalid(url) g_assert(!nm_sd_http_url_is_valid_https("" url))
+
+    _assert_valid("https://example.com/mud.json");
+    _assert_valid("https://example.com");
+    _assert_valid("https://example.com/a?b=c&d=e#frag");
+    _assert_valid("https://[2001:db8::1]/x");
+    _assert_valid("https://user@example.com/~p/(a)*,;=+!$'");
+    _assert_valid("https://user:pass@example.com/p%20q?x=%2F");
+
+    _assert_invalid("http://example.com");
+    _assert_invalid("ftp://example.com");
+    _assert_invalid("example.com");
+    _assert_invalid("");
+    _assert_invalid("https://");
+
+    _assert_invalid("https://example.com/\""); /* breaks out of the quoted string */
+    _assert_invalid("https://example.com/\\"); /* escapes the following char */
+    _assert_invalid("https://example.com/\n");
+    _assert_invalid("https://example.com/\t");
+    _assert_invalid("https://example.com/a\x01b");
+    _assert_invalid("https://example.com/\xc3\xa4"); /* non-ASCII */
+
+#undef _assert_valid
+#undef _assert_invalid
+}
+
+/*****************************************************************************/
+
 NMTST_DEFINE();
 
 int
@@ -91,6 +127,7 @@ main(int argc, char **argv)
     nmtst_init(&argc, &argv, TRUE);
 
     g_test_add_func("/systemd/sd-event", test_sd_event);
+    g_test_add_func("/systemd/http-url-is-valid-https", test_http_url_is_valid_https);
 
     return g_test_run();
 }