diff options
Diffstat (limited to 'debian')
17 files changed, 144 insertions, 317 deletions
diff --git a/debian/changelog b/debian/changelog index 79826fd5..7247a4b3 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,34 @@ +network-manager (1.14.6-2) unstable; urgency=medium + + * supplicant: fix setting pmf when the supplicant doesn't advertise support + + -- Michael Biebl <biebl@debian.org> Tue, 26 Feb 2019 21:23:14 +0100 + +network-manager (1.14.6-1) unstable; urgency=medium + + * New upstream version 1.14.6 + * Use debhelper-compat (= 12) Build-Depends and drop debian/compat + * Rebase patches + * Do not manage Docker bridge interfaces (Closes: #875127) + * Bump Standards-Version to 4.3.0 + + -- Michael Biebl <biebl@debian.org> Tue, 26 Feb 2019 19:33:53 +0100 + +network-manager (1.14.4-4) unstable; urgency=medium + + * Move D-Bus policy files to /usr/share/dbus-1/system.d/ + * Remove obsolete D-Bus policy conffiles on upgrades + + -- Michael Biebl <biebl@debian.org> Tue, 27 Nov 2018 01:35:50 +0100 + +network-manager (1.14.4-3) unstable; urgency=medium + + * cli: wait for all wifi scans to finish before displaying the result. + Otherwise devices are displayed in an inconsistent order. + Replaces debian/patches/Ignore-client-tests-failures.patch. + + -- Michael Biebl <biebl@debian.org> Mon, 05 Nov 2018 16:05:51 +0100 + network-manager (1.14.4-2~bpo9+1) stretch-backports; urgency=medium * Rebuild for stretch-backports diff --git a/debian/control b/debian/control index 45d1f3de..93dd20c6 100644 --- a/debian/control +++ b/debian/control @@ -40,7 +40,7 @@ Build-Depends: debhelper (>= 10.3), valac (>= 0.17.1.24), dbus <!nocheck>, python-dbus <!nocheck> -Standards-Version: 4.2.1 +Standards-Version: 4.3.0 Rules-Requires-Root: no Vcs-Git: https://salsa.debian.org/utopia-team/network-manager.git Vcs-Browser: https://salsa.debian.org/utopia-team/network-manager diff --git a/debian/network-manager.install b/debian/network-manager.install index bb751b47..0f1e82ae 100644 --- a/debian/network-manager.install +++ b/debian/network-manager.install @@ -14,10 +14,10 @@ usr/lib/pppd/*/*.so usr/share/locale/ usr/share/man/ usr/share/dbus-1/system-services/ +usr/share/dbus-1/system.d/org.freedesktop.NetworkManager.conf +usr/share/dbus-1/system.d/nm-dispatcher.conf usr/share/polkit-1/ usr/share/bash-completion/ -etc/dbus-1/system.d/org.freedesktop.NetworkManager.conf -etc/dbus-1/system.d/nm-dispatcher.conf etc/NetworkManager/dispatcher.d/ lib/udev/rules.d/*.rules lib/systemd/system/NetworkManager.service diff --git a/debian/network-manager.maintscript b/debian/network-manager.maintscript index c6b7a809..02266a64 100644 --- a/debian/network-manager.maintscript +++ b/debian/network-manager.maintscript @@ -1,2 +1,4 @@ rm_conffile /etc/dbus-1/system.d/nm-avahi-autoipd.conf 1.1.90-2~ mv_conffile /etc/NetworkManager/dispatcher.d/01ifupdown /etc/NetworkManager/dispatcher.d/01-ifupdown 1.8.0-5~ +rm_conffile /etc/dbus-1/system.d/nm-dispatcher.conf 1.14.4-4~ +rm_conffile /etc/dbus-1/system.d/org.freedesktop.NetworkManager.conf 1.14.4-4~ diff --git a/debian/patches/Do-not-manage-Docker-bridge-interfaces.patch b/debian/patches/Do-not-manage-Docker-bridge-interfaces.patch new file mode 100644 index 00000000..9525cc2a --- /dev/null +++ b/debian/patches/Do-not-manage-Docker-bridge-interfaces.patch @@ -0,0 +1,24 @@ +From: Andrei Dziahel <develop7@develop7.info> +Date: Mon, 17 Sep 2018 10:03:15 +0000 +Subject: Do not manage Docker bridge interfaces + +https://gitlab.freedesktop.org/NetworkManager/NetworkManager/merge_requests/15 +(cherry picked from commit 0ce73275506e8d3156b8d3cd9ca7a1105c5dc4fb) +--- + data/85-nm-unmanaged.rules | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/data/85-nm-unmanaged.rules b/data/85-nm-unmanaged.rules +index edc4ddb..20f4d29 100644 +--- a/data/85-nm-unmanaged.rules ++++ b/data/85-nm-unmanaged.rules +@@ -26,6 +26,9 @@ ATTR{address}=="00:1c:42:*", ENV{INTERFACE}=="vnic[0-9]*", ENV{NM_UNMANAGED}="1" + # in another net namespace and managed by libvirt, Docker or the like. + ENV{ID_NET_DRIVER}=="veth", ENV{NM_UNMANAGED}="1" + ++# Docker bridge. Managed by docker daemon. ++ATTR{address}=="02:42:*", ENV{INTERFACE}=="docker[0-9]*", ENV{NM_UNMANAGED}="1" ++ + # USB gadget device. Unmanage by default, since whatever created it + # might want to set it up itself (e.g. activate an ipv4.method=shared + # connection). diff --git a/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch b/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch index 636865a4..99543a19 100644 --- a/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch +++ b/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch @@ -10,10 +10,10 @@ to be autostarted by a client request. 2 files changed, 6 deletions(-) diff --git a/Makefile.am b/Makefile.am -index 1e100f6..204f1a0 100644 +index e1b442e..8428816 100644 --- a/Makefile.am +++ b/Makefile.am -@@ -4110,11 +4110,6 @@ endif +@@ -4105,11 +4105,6 @@ endif data/NetworkManager-dispatcher.service: $(srcdir)/data/NetworkManager-dispatcher.service.in $(AM_V_GEN) $(data_edit) $< >$@ diff --git a/debian/patches/Force-online-state-with-unmanaged-devices.patch b/debian/patches/Force-online-state-with-unmanaged-devices.patch index ae96f968..80d3158a 100644 --- a/debian/patches/Force-online-state-with-unmanaged-devices.patch +++ b/debian/patches/Force-online-state-with-unmanaged-devices.patch @@ -12,7 +12,7 @@ Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512286 1 file changed, 115 insertions(+) diff --git a/src/nm-manager.c b/src/nm-manager.c -index 7598995..1439c47 100644 +index 3ddc3b9..ada30d9 100644 --- a/src/nm-manager.c +++ b/src/nm-manager.c @@ -62,6 +62,8 @@ @@ -73,7 +73,7 @@ index 7598995..1439c47 100644 if ( new_state >= NM_STATE_CONNECTED_LOCAL && priv->connectivity_state == NM_CONNECTIVITY_FULL) { new_state = NM_STATE_CONNECTED_GLOBAL; -@@ -6209,6 +6239,62 @@ impl_manager_check_connectivity (NMDBusObject *obj, +@@ -6217,6 +6247,62 @@ impl_manager_check_connectivity (NMDBusObject *obj, nm_auth_chain_add_call (chain, NM_AUTH_PERMISSION_NETWORK_CONTROL, TRUE); } @@ -136,7 +136,7 @@ index 7598995..1439c47 100644 static void start_factory (NMDeviceFactory *factory, gpointer user_data) { -@@ -6377,6 +6463,9 @@ nm_manager_start (NMManager *self, GError **error) +@@ -6385,6 +6471,9 @@ nm_manager_start (NMManager *self, GError **error) nm_clear_g_source (&priv->devices_inited_id); priv->devices_inited_id = g_idle_add_full (G_PRIORITY_LOW + 10, devices_inited_cb, self, NULL); @@ -146,7 +146,7 @@ index 7598995..1439c47 100644 return TRUE; } -@@ -7231,6 +7320,22 @@ nm_manager_init (NMManager *self) +@@ -7239,6 +7328,22 @@ nm_manager_init (NMManager *self) KERNEL_FIRMWARE_DIR); } @@ -169,7 +169,7 @@ index 7598995..1439c47 100644 /* Update timestamps in active connections */ priv->timestamp_update_id = g_timeout_add_seconds (300, (GSourceFunc) periodic_update_active_connection_timestamps, self); -@@ -7506,6 +7611,16 @@ dispose (GObject *object) +@@ -7514,6 +7619,16 @@ dispose (GObject *object) g_clear_object (&priv->fw_monitor); } diff --git a/debian/patches/Ignore-client-tests-failures.patch b/debian/patches/Ignore-client-tests-failures.patch deleted file mode 100644 index a56af7d7..00000000 --- a/debian/patches/Ignore-client-tests-failures.patch +++ /dev/null @@ -1,26 +0,0 @@ -From: Michael Biebl <biebl@debian.org> -Date: Thu, 25 Oct 2018 00:09:31 +0200 -Subject: Ignore client/tests failures - -check-local-clients-tests-test-client appears to be flaky and prone to -fail on slower architectures. Ignore failures of this test until this -has been properly investigated. - -https://gitlab.freedesktop.org/NetworkManager/NetworkManager/issues/39 ---- - Makefile.am | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile.am b/Makefile.am -index 204f1a0..9181ad1 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -4056,7 +4056,7 @@ check-local-clients-tests-test-client: clients/cli/nmcli clients/tests/test-clie - "$(PYTHON)" \ - $(srcdir)/clients/tests/test-client.py -v &> "$(builddir)/clients/tests/test-client.log" && r=ok; \ - cat "$(builddir)/clients/tests/test-client.log"; \ -- test "$$r" == ok -+ true - - check_local += check-local-clients-tests-test-client - diff --git a/debian/patches/dhcp6-fix-buffer-size-checking.patch b/debian/patches/dhcp6-fix-buffer-size-checking.patch deleted file mode 100644 index 921573b8..00000000 --- a/debian/patches/dhcp6-fix-buffer-size-checking.patch +++ /dev/null @@ -1,25 +0,0 @@ -From: Yu Watanabe <watanabe.yu+github@gmail.com> -Date: Thu, 27 Sep 2018 23:48:51 +0900 -Subject: dhcp6: fix buffer size checking - -(cherry picked from commit cb1bdeaf56852275e6b0dd1fba932bb174767f70) -(cherry picked from commit 91fb1673d5217aaf1461998fd2675630f5c265f9) ---- - src/systemd/src/libsystemd-network/sd-dhcp6-client.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c -index 8444a75..0b261a2 100644 ---- a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c -+++ b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c -@@ -818,8 +818,8 @@ static int client_parse_message( - uint8_t *optval; - be32_t iaid_lease; - -- if (len < offsetof(DHCP6Option, data) || -- len < offsetof(DHCP6Option, data) + be16toh(option->len)) -+ if (len < pos + offsetof(DHCP6Option, data) || -+ len < pos + offsetof(DHCP6Option, data) + be16toh(option->len)) - return -ENOBUFS; - - optcode = be16toh(option->code); diff --git a/debian/patches/dhcp6-make-sure-we-have-enough-space-for-the-DHCP6-option.patch b/debian/patches/dhcp6-make-sure-we-have-enough-space-for-the-DHCP6-option.patch deleted file mode 100644 index 3c5c4051..00000000 --- a/debian/patches/dhcp6-make-sure-we-have-enough-space-for-the-DHCP6-option.patch +++ /dev/null @@ -1,31 +0,0 @@ -From: Lennart Poettering <lennart@poettering.net> -Date: Fri, 19 Oct 2018 12:12:33 +0200 -Subject: dhcp6: make sure we have enough space for the DHCP6 option header - -Fixes a vulnerability originally discovered by Felix Wilhelm from -Google. - -CVE-2018-15688 -LP: #1795921 -https://bugzilla.redhat.com/show_bug.cgi?id=1639067 - -(cherry picked from commit 4dac5eaba4e419b29c97da38a8b1f82336c2c892) -(cherry picked from commit 01ca2053bbea09f35b958c8cc7631e15469acb79) -(cherry picked from commit fc230dca139142f409d7bac99dbfabe9b004e2fb) ---- - src/systemd/src/libsystemd-network/dhcp6-option.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c -index be5c222..2297044 100644 ---- a/src/systemd/src/libsystemd-network/dhcp6-option.c -+++ b/src/systemd/src/libsystemd-network/dhcp6-option.c -@@ -105,7 +105,7 @@ int dhcp6_option_append_ia(uint8_t **buf, size_t *buflen, DHCP6IA *ia) { - return -EINVAL; - } - -- if (*buflen < len) -+ if (*buflen < offsetof(DHCP6Option, data) + len) - return -ENOBUFS; - - ia_hdr = *buf; diff --git a/debian/patches/sd-dhcp-lease-fix-memleaks.patch b/debian/patches/sd-dhcp-lease-fix-memleaks.patch deleted file mode 100644 index 4866a6f6..00000000 --- a/debian/patches/sd-dhcp-lease-fix-memleaks.patch +++ /dev/null @@ -1,23 +0,0 @@ -From: Yu Watanabe <watanabe.yu+github@gmail.com> -Date: Thu, 27 Sep 2018 18:04:59 +0900 -Subject: sd-dhcp-lease: fix memleaks - -(cherry picked from commit e2975f854831d08a25b4f5eb329b6d04102e115f) -(cherry picked from commit 157094abd83f933fad142758a7d177cfa1a347f7) ---- - src/systemd/src/libsystemd-network/sd-dhcp-lease.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/systemd/src/libsystemd-network/sd-dhcp-lease.c b/src/systemd/src/libsystemd-network/sd-dhcp-lease.c -index d240259..cac07d3 100644 ---- a/src/systemd/src/libsystemd-network/sd-dhcp-lease.c -+++ b/src/systemd/src/libsystemd-network/sd-dhcp-lease.c -@@ -279,6 +279,8 @@ sd_dhcp_lease *sd_dhcp_lease_unref(sd_dhcp_lease *lease) { - free(option); - } - -+ free(lease->root_path); -+ free(lease->timezone); - free(lease->hostname); - free(lease->domainname); - free(lease->dns); diff --git a/debian/patches/sd-dhcp-remove-unreachable-route-after-rebinding-return-N.patch b/debian/patches/sd-dhcp-remove-unreachable-route-after-rebinding-return-N.patch deleted file mode 100644 index f49c9476..00000000 --- a/debian/patches/sd-dhcp-remove-unreachable-route-after-rebinding-return-N.patch +++ /dev/null @@ -1,24 +0,0 @@ -From: Li Song <song.li@honeywell.com> -Date: Fri, 19 Oct 2018 13:41:51 -0400 -Subject: sd-dhcp: remove unreachable route after rebinding return NAK - -(cherry picked from commit cc3981b1272b9ce37e7d734a7b2f42e84acac535) -(cherry picked from commit 915c2f675a23b2ae16d292d1ac570706f76b384d) -(cherry picked from commit cb77290a696dce924e2a993690634986ac035490) ---- - src/systemd/src/libsystemd-network/sd-dhcp-client.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/systemd/src/libsystemd-network/sd-dhcp-client.c b/src/systemd/src/libsystemd-network/sd-dhcp-client.c -index 42707f1..9158945 100644 ---- a/src/systemd/src/libsystemd-network/sd-dhcp-client.c -+++ b/src/systemd/src/libsystemd-network/sd-dhcp-client.c -@@ -1688,6 +1688,8 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, i - client->timeout_resend = - sd_event_source_unref(client->timeout_resend); - -+ client_notify(client, SD_DHCP_CLIENT_EVENT_EXPIRED); -+ - r = client_initialize(client); - if (r < 0) - goto error; diff --git a/debian/patches/sd-dhcp6-fix-argument-and-error-handling-of-dhcp6_option_.patch b/debian/patches/sd-dhcp6-fix-argument-and-error-handling-of-dhcp6_option_.patch deleted file mode 100644 index c04a95a9..00000000 --- a/debian/patches/sd-dhcp6-fix-argument-and-error-handling-of-dhcp6_option_.patch +++ /dev/null @@ -1,60 +0,0 @@ -From: Yu Watanabe <watanabe.yu+github@gmail.com> -Date: Fri, 19 Oct 2018 03:44:56 +0900 -Subject: sd-dhcp6: fix argument and error handling of - dhcp6_option_parse_status() - -(cherry picked from commit 91c43f3978fa7c8341550b9ca279e460ba7e74e6) -(cherry picked from commit 373cbfc8c6e9591b3c8cc12d58c4b31ac35ab24f) -(cherry picked from commit 0e93fd895daa6f0f578ffa8fc4ed3e0ea85c62e8) ---- - src/systemd/src/libsystemd-network/dhcp6-option.c | 10 ++++++---- - src/systemd/src/libsystemd-network/sd-dhcp6-client.c | 9 +++++---- - 2 files changed, 11 insertions(+), 8 deletions(-) - -diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c -index ff1cbf1..cfddefc 100644 ---- a/src/systemd/src/libsystemd-network/dhcp6-option.c -+++ b/src/systemd/src/libsystemd-network/dhcp6-option.c -@@ -465,13 +465,15 @@ int dhcp6_option_parse_ia(DHCP6Option *iaoption, DHCP6IA *ia) { - - case SD_DHCP6_OPTION_STATUS_CODE: - -- status = dhcp6_option_parse_status(option, optlen); -- if (status) { -+ status = dhcp6_option_parse_status(option, optlen + sizeof(DHCP6Option)); -+ if (status < 0) { -+ r = status; -+ goto error; -+ } -+ if (status > 0) { - log_dhcp6_client(client, "IA status %d", - status); - -- dhcp6_lease_free_ia(ia); -- - r = -EINVAL; - goto error; - } -diff --git a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c -index 0b261a2..b694786 100644 ---- a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c -+++ b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c -@@ -870,13 +870,14 @@ static int client_parse_message( - break; - - case SD_DHCP6_OPTION_STATUS_CODE: -- status = dhcp6_option_parse_status(option, optlen); -- if (status) { -+ status = dhcp6_option_parse_status(option, optlen + sizeof(DHCP6Option)); -+ if (status < 0) -+ return status; -+ -+ if (status > 0) { - log_dhcp6_client(client, "%s Status %s", - dhcp6_message_type_to_string(message->type), - dhcp6_message_status_to_string(status)); -- dhcp6_lease_free_ia(&lease->ia); -- dhcp6_lease_free_ia(&lease->pd); - - return -EINVAL; - } diff --git a/debian/patches/sd-dhcp6-make-dhcp6_option_parse_domainname-not-store-emp.patch b/debian/patches/sd-dhcp6-make-dhcp6_option_parse_domainname-not-store-emp.patch deleted file mode 100644 index f8144605..00000000 --- a/debian/patches/sd-dhcp6-make-dhcp6_option_parse_domainname-not-store-emp.patch +++ /dev/null @@ -1,111 +0,0 @@ -From: Yu Watanabe <watanabe.yu+github@gmail.com> -Date: Fri, 19 Oct 2018 03:42:10 +0900 -Subject: sd-dhcp6: make dhcp6_option_parse_domainname() not store empty - domain - -This improves performance of fuzzer. -C.f. oss-fuzz#11019. - -(cherry picked from commit 3c72b6ed4252e7ff5f7704bfe44557ec197b47fa) -(cherry picked from commit 50403cccee28c7dcd54b138a0d3b3f69ea0204fe) -(cherry picked from commit f11f5abb1a8b96b553d2d156f8b5cf440695c04d) ---- - src/systemd/src/libsystemd-network/dhcp6-option.c | 66 ++++++++++------------- - 1 file changed, 29 insertions(+), 37 deletions(-) - -diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c -index cfddefc..be5c222 100644 ---- a/src/systemd/src/libsystemd-network/dhcp6-option.c -+++ b/src/systemd/src/libsystemd-network/dhcp6-option.c -@@ -555,6 +555,7 @@ int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char * - bool first = true; - - for (;;) { -+ const char *label; - uint8_t c; - - c = optval[pos++]; -@@ -562,47 +563,41 @@ int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char * - if (c == 0) - /* End of name */ - break; -- else if (c <= 63) { -- const char *label; -- -- /* Literal label */ -- label = (const char *)&optval[pos]; -- pos += c; -- if (pos >= optlen) -- return -EMSGSIZE; -- -- if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX)) { -- r = -ENOMEM; -- goto fail; -- } -- -- if (first) -- first = false; -- else -- ret[n++] = '.'; -- -- r = dns_label_escape(label, c, ret + n, DNS_LABEL_ESCAPED_MAX); -- if (r < 0) -- goto fail; -- -- n += r; -- continue; -- } else { -- r = -EBADMSG; -- goto fail; -- } -- } -+ if (c > 63) -+ return -EBADMSG; -+ -+ /* Literal label */ -+ label = (const char *)&optval[pos]; -+ pos += c; -+ if (pos >= optlen) -+ return -EMSGSIZE; -+ -+ if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX)) -+ return -ENOMEM; -+ -+ if (first) -+ first = false; -+ else -+ ret[n++] = '.'; -+ -+ r = dns_label_escape(label, c, ret + n, DNS_LABEL_ESCAPED_MAX); -+ if (r < 0) -+ return r; - -- if (!GREEDY_REALLOC(ret, allocated, n + 1)) { -- r = -ENOMEM; -- goto fail; -+ n += r; - } - -+ if (n == 0) -+ continue; -+ -+ if (!GREEDY_REALLOC(ret, allocated, n + 1)) -+ return -ENOMEM; -+ - ret[n] = 0; - - r = strv_extend(&names, ret); - if (r < 0) -- goto fail; -+ return r; - - idx++; - } -@@ -610,7 +605,4 @@ int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char * - *str_arr = TAKE_PTR(names); - - return idx; -- --fail: -- return r; - } diff --git a/debian/patches/series b/debian/patches/series index 5be1814f..b21e8a16 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,10 +1,5 @@ +Do-not-manage-Docker-bridge-interfaces.patch +supplicant-fix-setting-pmf-when-the-supplicant-doesn-t-ad.patch Force-online-state-with-unmanaged-devices.patch Don-t-setup-Sleep-Monitor-if-not-booted-with-systemd.patch Don-t-make-NetworkManager-D-Bus-activatable.patch -Ignore-client-tests-failures.patch -sd-dhcp-lease-fix-memleaks.patch -dhcp6-fix-buffer-size-checking.patch -sd-dhcp6-fix-argument-and-error-handling-of-dhcp6_option_.patch -sd-dhcp6-make-dhcp6_option_parse_domainname-not-store-emp.patch -sd-dhcp-remove-unreachable-route-after-rebinding-return-N.patch -dhcp6-make-sure-we-have-enough-space-for-the-DHCP6-option.patch diff --git a/debian/patches/supplicant-fix-setting-pmf-when-the-supplicant-doesn-t-ad.patch b/debian/patches/supplicant-fix-setting-pmf-when-the-supplicant-doesn-t-ad.patch new file mode 100644 index 00000000..38930c48 --- /dev/null +++ b/debian/patches/supplicant-fix-setting-pmf-when-the-supplicant-doesn-t-ad.patch @@ -0,0 +1,74 @@ +From: Beniamino Galvani <bgalvani@redhat.com> +Date: Mon, 25 Feb 2019 08:38:22 +0100 +Subject: supplicant: fix setting pmf when the supplicant doesn't advertise + support + +wpa_supplicant only advertises pmf support since commit [1], which is +after 2.6. When using a version without that commit (for example, +plain 2.6), we would unconditionally set the global Pmf property to 1 +(optional) and then skip setting the per-network property. The result +was that pmf was enabled without the possibility to disable it by +user. The correct behavior is instead to disable pmf on such versions. + +[1] https://w1.fi/cgit/hostap/commit/?id=3cdb4ac074f76accf24a51d143db545afad2c90b + +https://gitlab.freedesktop.org/NetworkManager/NetworkManager/issues/129 +(cherry picked from commit 560a35dd433cd6bf2268aaf757fda798f35712fe) +(cherry picked from commit b837561bb6fc09d4134ac8c5c6dc5ac1885ebf62) +(cherry picked from commit 353743b99520ba481d08b52b31af16dcfc80d39f) +--- + src/supplicant/nm-supplicant-interface.c | 33 +++++++++++++++++--------------- + 1 file changed, 18 insertions(+), 15 deletions(-) + +diff --git a/src/supplicant/nm-supplicant-interface.c b/src/supplicant/nm-supplicant-interface.c +index 0af9ebd..b2a89ce 100644 +--- a/src/supplicant/nm-supplicant-interface.c ++++ b/src/supplicant/nm-supplicant-interface.c +@@ -568,9 +568,8 @@ iface_set_pmf_cb (GDBusProxy *proxy, GAsyncResult *result, gpointer user_data) + + self = NM_SUPPLICANT_INTERFACE (user_data); + +- /* This can fail if the supplicant doesn't support PMF */ + if (error) +- _LOGD ("failed to set Pmf=1: %s", error->message); ++ _LOGW ("failed to set Pmf=1: %s", error->message); + + iface_check_ready (self); + } +@@ -1175,19 +1174,23 @@ on_iface_proxy_acquired (GDBusProxy *proxy, GAsyncResult *result, gpointer user_ + NULL, + NULL); + +- /* Initialize global PMF setting to 'optional' */ +- priv->ready_count = 1; +- g_dbus_proxy_call (priv->iface_proxy, +- DBUS_INTERFACE_PROPERTIES ".Set", +- g_variant_new ("(ssv)", +- WPAS_DBUS_IFACE_INTERFACE, +- "Pmf", +- g_variant_new_string ("1")), +- G_DBUS_CALL_FLAGS_NONE, +- -1, +- priv->init_cancellable, +- (GAsyncReadyCallback) iface_set_pmf_cb, +- self); ++ priv->ready_count = 0; ++ ++ if (priv->pmf_support == NM_SUPPLICANT_FEATURE_YES) { ++ /* Initialize global PMF setting to 'optional' */ ++ priv->ready_count++; ++ g_dbus_proxy_call (priv->iface_proxy, ++ DBUS_INTERFACE_PROPERTIES ".Set", ++ g_variant_new ("(ssv)", ++ WPAS_DBUS_IFACE_INTERFACE, ++ "Pmf", ++ g_variant_new_string ("1")), ++ G_DBUS_CALL_FLAGS_NONE, ++ -1, ++ priv->init_cancellable, ++ (GAsyncReadyCallback) iface_set_pmf_cb, ++ self); ++ } + + /* Check whether NetworkReply and AP mode are supported */ + priv->ready_count++; diff --git a/debian/rules b/debian/rules index 28e8eca5..5206261f 100755 --- a/debian/rules +++ b/debian/rules @@ -28,6 +28,7 @@ override_dh_auto_configure: --with-dnssec-trigger=/usr/lib/dnssec-trigger/dnssec-trigger-script \ --with-systemdsystemunitdir=/lib/systemd/system \ --with-udev-dir=/lib/udev \ + --with-dbus-sys-dir=/usr/share/dbus-1/system.d \ --with-crypto=gnutls \ --with-session-tracking=systemd \ --with-suspend-resume=systemd \ |