Update upstream source from tag 'upstream/1.56.0'

Update to upstream version '1.56.0'
with Debian dir 15fab61a7abf1fd4e2ba46785f96d935e87d32bb

2 files changed, 56 insertions, 15 deletions

diff --git a/src/nmcli/devices.c b/src/nmcli/devices.c
index 9a018113..e81e710f 100644
--- a/src/nmcli/devices.c
+++ b/src/nmcli/devices.c
@@ -2090,6 +2090,7 @@ typedef struct {
     char               *specific_object;
     bool                hotspot : 1;
     bool                create : 1;
+    bool                start_agent : 1;
 } AddAndActivateInfo;
 
 static AddAndActivateInfo *
@@ -2097,6 +2098,7 @@ add_and_activate_info_new(NmCli      *nmc,
                           NMDevice   *device,
                           gboolean    hotspot,
                           gboolean    create,
+                          gboolean    start_agent,
                           const char *specific_object)
 {
     AddAndActivateInfo *info;
@@ -2107,6 +2109,7 @@ add_and_activate_info_new(NmCli      *nmc,
         .device          = g_object_ref(device),
         .hotspot         = hotspot,
         .create          = create,
+        .start_agent     = start_agent,
         .specific_object = g_strdup(specific_object),
     };
     return info;
@@ -2364,7 +2367,7 @@ do_device_connect(const NMCCommand *cmd, NmCli *nmc, int argc, const char *const
                          nmc);
     }
 
-    info = add_and_activate_info_new(nmc, device, FALSE, FALSE, NULL);
+    info = add_and_activate_info_new(nmc, device, FALSE, FALSE, FALSE, NULL);
 
     nm_client_activate_connection_async(nmc->client,
                                         NULL, /* let NM find a connection automatically */
@@ -3603,6 +3606,16 @@ activate_update2_cb(GObject *source_object, GAsyncResult *res, gpointer user_dat
         return;
     }
 
+    if (info->start_agent && !nmc->secret_agent) {
+        nmc->secret_agent = nm_secret_agent_simple_new("nmcli-connect");
+        if (nmc->secret_agent) {
+            g_signal_connect(nmc->secret_agent,
+                             NM_SECRET_AGENT_SIMPLE_REQUEST_SECRETS,
+                             G_CALLBACK(nmc_secrets_requested),
+                             nmc);
+        }
+    }
+
     nm_client_activate_connection_async(nmc->client,
                                         NM_CONNECTION(remote_con),
                                         info->device,
@@ -3617,6 +3630,7 @@ save_and_activate_connection(NmCli        *nmc,
                              NMDevice     *device,
                              NMConnection *connection,
                              gboolean      hotspot,
+                             gboolean      start_agent,
                              const char   *specific_object)
 {
     AddAndActivateInfo *info;
@@ -3625,9 +3639,15 @@ save_and_activate_connection(NmCli        *nmc,
                                      device,
                                      hotspot,
                                      !NM_IS_REMOTE_CONNECTION(connection),
+                                     start_agent,
                                      specific_object);
 
     if (NM_IS_REMOTE_CONNECTION(connection)) {
+        /* Don't start the agent immediately. Otherwise the agent registration
+         * to the daemon will trigger a new activation if the connection was
+         * blocked due to bad secrets. This new activation would use the old
+         * secrets.
+         */
         nm_remote_connection_update2(NM_REMOTE_CONNECTION(connection),
                                      nm_connection_to_dbus(connection, NM_CONNECTION_SERIALIZE_ALL),
                                      NM_SETTINGS_UPDATE2_FLAG_BLOCK_AUTOCONNECT,
@@ -3636,6 +3656,16 @@ save_and_activate_connection(NmCli        *nmc,
                                      activate_update2_cb,
                                      info);
     } else {
+        if (start_agent) {
+            nmc->secret_agent = nm_secret_agent_simple_new("nmcli-connect");
+            if (nmc->secret_agent) {
+                g_signal_connect(nmc->secret_agent,
+                                 NM_SECRET_AGENT_SIMPLE_REQUEST_SECRETS,
+                                 G_CALLBACK(nmc_secrets_requested),
+                                 nmc);
+            }
+        }
+
         nm_client_add_and_activate_connection_async(nmc->client,
                                                     connection,
                                                     info->device,
@@ -3665,6 +3695,7 @@ do_device_wifi_connect(const NMCCommand *cmd, NmCli *nmc, int argc, const char *
     gboolean private                         = FALSE;
     gboolean           hidden                = FALSE;
     gboolean           wep_passphrase        = FALSE;
+    gboolean           start_agent           = FALSE;
     GByteArray        *bssid1_arr            = NULL;
     GByteArray        *bssid2_arr            = NULL;
     gs_free NMDevice **devices               = NULL;
@@ -4029,18 +4060,13 @@ do_device_wifi_connect(const NMCCommand *cmd, NmCli *nmc, int argc, const char *
                              NM_802_11_AP_SEC_KEY_MGMT_OWE | NM_802_11_AP_SEC_KEY_MGMT_OWE_TM))) {
         NMSettingWirelessSecurity *s_wsec = NULL;
 
-        /* Create secret agent */
-        nmc->secret_agent = nm_secret_agent_simple_new("nmcli-connect");
-        if (nmc->secret_agent) {
-            g_signal_connect(nmc->secret_agent,
-                             NM_SECRET_AGENT_SIMPLE_REQUEST_SECRETS,
-                             G_CALLBACK(nmc_secrets_requested),
-                             nmc);
-        }
+        /* Start the secret agent just before initiating the activation. */
+        start_agent = TRUE;
 
         if (password) {
             if (!connection)
                 connection = nm_simple_connection_new();
+            s_wsec = nm_connection_get_setting_wireless_security(connection);
             if (!s_wsec) {
                 s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new();
                 nm_connection_add_setting(connection, NM_SETTING(s_wsec));
@@ -4075,7 +4101,12 @@ do_device_wifi_connect(const NMCCommand *cmd, NmCli *nmc, int argc, const char *
     nmc->nowait_flag = (nmc->timeout == 0);
     nmc->should_wait++;
 
-    save_and_activate_connection(nmc, device, connection, FALSE, nm_object_get_path(NM_OBJECT(ap)));
+    save_and_activate_connection(nmc,
+                                 device,
+                                 connection,
+                                 FALSE,
+                                 start_agent,
+                                 nm_object_get_path(NM_OBJECT(ap)));
 
 finish:
     if (bssid1_arr)
@@ -4535,7 +4566,7 @@ do_device_wifi_hotspot(const NMCCommand *cmd, NmCli *nmc, int argc, const char *
     nmc->nowait_flag = (nmc->timeout == 0);
     nmc->should_wait++;
 
-    save_and_activate_connection(nmc, device, connection, TRUE, NULL);
+    save_and_activate_connection(nmc, device, connection, TRUE, FALSE, NULL);
 }
 
 static void
diff --git a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
index 854a0227..881c41ca 100644
--- a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
+++ b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
@@ -733,10 +733,14 @@
                   nmcli-description="Whether DNSOverTls (dns-over-tls) is enabled for the connection. DNSOverTls is a technology which uses TLS to encrypt dns traffic. The permitted values are: "yes" (2) use DNSOverTls and disabled fallback, "opportunistic" (1) use DNSOverTls but allow fallback to unencrypted resolution, "no" (0) don't ever use DNSOverTls. If unspecified "default" depends on the plugin used. Systemd-resolved uses global setting. This feature requires a plugin which supports DNSOverTls. Otherwise, the setting has no effect. One such plugin is dns-systemd-resolved."
                   format="choice (NMSettingConnectionDnsOverTls)"
                   values="default (-1), no (0), opportunistic (1), yes (2)" />
+        <property name="dnssec"
+                  nmcli-description="Whether DNSSEC (dnssec) is enabled for the connection. The permitted values are: &quot;yes&quot; (2) use DNSSEC and disable fallback, &quot;allow-downgrade&quot; (1) use DNSSEC but allow fallback if the server does not support it, &quot;no&quot; (0) don&apos;t ever use DNSSEC. The effect of &quot;default&quot; (-1) depends on the dns plugin used. Systemd-resolved uses its global setting in this case. This feature requires a plugin which supports DNSSEC. Otherwise, the setting has no effect. One such plugin is systemd-resolved."
+                  format="choice (NMSettingConnectionDnssec)"
+                  values="default (-1), no (0), allow-downgrade (1), yes (2)" />
         <property name="mptcp-flags"
-                  nmcli-description="Whether to configure MPTCP endpoints and the address flags. If MPTCP is enabled in NetworkManager, it will configure the addresses of the interface as MPTCP endpoints. Note that IPv4 loopback addresses (127.0.0.0/8), IPv4 link local addresses (169.254.0.0/16), the IPv6 loopback address (::1), IPv6 link local addresses (fe80::/10), IPv6 unique local addresses (ULA, fc00::/7) and IPv6 privacy extension addresses (rfc3041, ipv6.ip6-privacy) will be excluded from being configured as endpoints. If &quot;disabled&quot; (0x1), MPTCP handling for the interface is disabled and no endpoints are registered. The &quot;enabled&quot; (0x2) flag means that MPTCP handling is enabled. This flag can also be implied from the presence of other flags. Even when enabled, MPTCP handling will by default still be disabled unless &quot;/proc/sys/net/mptcp/enabled&quot; sysctl is on. NetworkManager does not change the sysctl and this is up to the administrator or distribution. To configure endpoints even if the sysctl is disabled, &quot;also-without-sysctl&quot; (0x4) flag can be used. In that case, NetworkManager doesn&apos;t look at the sysctl and configures endpoints regardless. Even when enabled, NetworkManager will only configure MPTCP endpoints for a certain address family, if there is a unicast default route (0.0.0.0/0 or ::/0) in the main routing table. The flag &quot;also-without-default-route&quot; (0x8) can override that. When MPTCP handling is enabled then endpoints are configured with the specified address flags &quot;signal&quot; (0x10), &quot;subflow&quot; (0x20), &quot;backup&quot; (0x40), &quot;fullmesh&quot; (0x80). See ip-mptcp(8) manual for additional information about the flags. If the flags are zero (0x0), the global connection default from NetworkManager.conf is honored. If still unspecified, the fallback is &quot;enabled,subflow&quot;. Note that this means that MPTCP is by default done depending on the &quot;/proc/sys/net/mptcp/enabled&quot; sysctl. NetworkManager does not change the MPTCP limits nor enable MPTCP via &quot;/proc/sys/net/mptcp/enabled&quot;. That is a host configuration which the admin can change via sysctl and ip-mptcp. Strict reverse path filtering (rp_filter) breaks many MPTCP use cases, so when MPTCP handling for IPv4 addresses on the interface is enabled, NetworkManager would loosen the strict reverse path filtering (1) to the loose setting (2)."
+                  nmcli-description="Whether to configure MPTCP endpoints and the address flags. If MPTCP is enabled in NetworkManager, it will configure the addresses of the interface as MPTCP endpoints. Note that IPv4 loopback addresses (127.0.0.0/8), IPv4 link local addresses (169.254.0.0/16), the IPv6 loopback address (::1), IPv6 link local addresses (fe80::/10), IPv6 unique local addresses (ULA, fc00::/7) and IPv6 privacy extension addresses (rfc3041, ipv6.ip6-privacy) will be excluded from being configured as endpoints. If &quot;disabled&quot; (0x1), MPTCP handling for the interface is disabled and no endpoints are registered. The &quot;enabled&quot; (0x2) flag means that MPTCP handling is enabled. This flag can also be implied from the presence of other flags. Even when enabled, MPTCP handling will by default still be disabled unless &quot;/proc/sys/net/mptcp/enabled&quot; sysctl is on. NetworkManager does not change the sysctl and this is up to the administrator or distribution. To configure endpoints even if the sysctl is disabled, &quot;also-without-sysctl&quot; (0x4) flag can be used. In that case, NetworkManager doesn&apos;t look at the sysctl and configures endpoints regardless. Even when enabled, NetworkManager will only configure MPTCP endpoints for a certain address family, if there is a unicast default route (0.0.0.0/0 or ::/0) in the main routing table. The flag &quot;also-without-default-route&quot; (0x8) can override that. When MPTCP handling is enabled then endpoints are configured with the specified address flags &quot;signal&quot; (0x10), &quot;subflow&quot; (0x20), &quot;backup&quot; (0x40), &quot;fullmesh&quot; (0x80), &quot;laminar&quot; (0x100). See ip-mptcp(8) manual for additional information about the flags. If the flags are zero (0x0), the global connection default from NetworkManager.conf is honored. If still unspecified, the fallback is &quot;enabled,subflow&quot;. Note that this means that MPTCP is by default done depending on the &quot;/proc/sys/net/mptcp/enabled&quot; sysctl. NetworkManager does not change the MPTCP limits nor enable MPTCP via &quot;/proc/sys/net/mptcp/enabled&quot;. That is a host configuration which the admin can change via sysctl and ip-mptcp. Strict reverse path filtering (rp_filter) breaks many MPTCP use cases, so when MPTCP handling for IPv4 addresses on the interface is enabled, NetworkManager would loosen the strict reverse path filtering (1) to the loose setting (2)."
                   format="flags (NMMptcpFlags)"
-                  values="none/default (0x0), disabled (0x1), enabled (0x2), also-without-sysctl (0x4), also-without-default-route (0x8), signal (0x10), subflow (0x20), backup (0x40), fullmesh (0x80)" />
+                  values="none/default (0x0), disabled (0x1), enabled (0x2), also-without-sysctl (0x4), also-without-default-route (0x8), signal (0x10), subflow (0x20), backup (0x40), fullmesh (0x80), laminar (0x100)" />
         <property name="mud-url"
                   nmcli-description="If configured, set to a Manufacturer Usage Description (MUD) URL that points to manufacturer-recommended network policies for IoT devices. It is transmitted as a DHCPv4 or DHCPv6 option. The value must be a valid URL starting with &quot;https://&quot;. The special value &quot;none&quot; is allowed to indicate that no MUD URL is used. If the per-profile value is unspecified (the default), a global connection default gets consulted. If still unspecified, the ultimate default is &quot;none&quot;."
                   format="string" />
@@ -1198,6 +1202,9 @@
                   nmcli-description="For LTE modems, this disables MSCHAPV2 authentication method for the initial EPS bearer that is set up when attaching to the network."
                   format="boolean"
                   values="true/yes/on, false/no/off" />
+        <property name="device-uid"
+                  nmcli-description="The device UID (as given by the WWAN management service) which this connection applies to. In contrast to &quot;device-id&quot;, which is an inherent property of the connected device, this setting refers to a property set by a UDEV-rule. Refer to the &quot;Common udev tags&quot; -&gt; &quot;ID_MM_PHYSDEV_UID&quot; documentation of ModemManager. If given, the connection will only apply to the specified device."
+                  format="string" />
     </setting>
     <setting name="hostname" >
         <property name="priority"
@@ -1350,7 +1357,7 @@
                   format="list of ipv4.addresses objects" />
         <property name="gateway"
                   alias="gw4"
-                  nmcli-description="The gateway associated with this configuration. This is only meaningful if &quot;addresses&quot; is also set. Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if &quot;never-default&quot; is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length. Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See &quot;ip4-auto-default-route&quot;."
+                  nmcli-description="The gateway associated with this configuration. This is only meaningful if addresses are also set on the device. Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if &quot;never-default&quot; is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length. Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See &quot;ip4-auto-default-route&quot;."
                   format="IPv4 address" />
         <property name="routes"
                   nmcli-description="A list of IPv4 destination addresses, prefix length, optional IPv4 next hop addresses, optional route metric, optional attribute. The valid syntax is: &quot;ip[/prefix] [next-hop] [metric] [attribute=val]...[,ip[/prefix]...]&quot;. For example &quot;192.0.2.0/24 10.1.1.1 77, 198.51.100.0/24&quot;."
@@ -1492,7 +1499,7 @@
                   format="list of ipv6.addresses objects" />
         <property name="gateway"
                   alias="gw6"
-                  nmcli-description="The gateway associated with this configuration. This is only meaningful if &quot;addresses&quot; is also set. Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if &quot;never-default&quot; is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length. Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See &quot;ip4-auto-default-route&quot;."
+                  nmcli-description="The gateway associated with this configuration. This is only meaningful if addresses are also set on the device. Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if &quot;never-default&quot; is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length. Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See &quot;ip4-auto-default-route&quot;."
                   format="IPv6 address" />
         <property name="routes"
                   nmcli-description="Array of IP routes."
@@ -2331,6 +2338,9 @@
                   nmcli-description="Like ip4-auto-default-route, but for the IPv6 default route."
                   format="ternary"
                   values="true/yes/on, false/no/off, default/unknown" />
+        <property name="peers"
+                  nmcli-description="A comma-separated list of WireGuard peers. Each peer has the following syntax: PUBLIC_KEY [ATTRIBUTE=VALUE [ATTRIBUTE=VALUE]...] The supported attributes are: endpoint, allowed-ips, persistent-keepalive,  preshared-key, preshared-key-flags."
+                  format="list of wireguard.peers objects" />
     </setting>
     <setting name="wpan" >
         <property name="mac-address"