diff options
Diffstat (limited to 'debian')
17 files changed, 866 insertions, 26 deletions
diff --git a/debian/patches/Fix-polkit-agent-helper-1-path.patch b/debian/patches/Fix-polkit-agent-helper-1-path.patch deleted file mode 100644 index f8005e6d..00000000 --- a/debian/patches/Fix-polkit-agent-helper-1-path.patch +++ /dev/null @@ -1,25 +0,0 @@ -From: Michael Biebl <biebl@debian.org> -Date: Thu, 11 Feb 2021 19:21:46 +0100 -Subject: Fix polkit-agent-helper-1 path - -Use /usr/lib/policykit-1/polkit-agent-helper-1, as this path also works -on buster, i.e. the current stable release. -It should eventually be updated to use /usr/libexec once bullseye has -been released. ---- - clients/common/nm-polkit-listener.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/clients/common/nm-polkit-listener.c b/clients/common/nm-polkit-listener.c -index db21abf..204d734 100644 ---- a/clients/common/nm-polkit-listener.c -+++ b/clients/common/nm-polkit-listener.c -@@ -501,7 +501,7 @@ begin_authentication(AuthRequest *request) - { - int fd_flags; - const char *helper_argv[] = { -- POLKIT_PACKAGE_PREFIX "/lib/polkit-1/polkit-agent-helper-1", -+ "/usr/lib/policykit-1/polkit-agent-helper-1", - request->username, - NULL, - }; diff --git a/debian/patches/build-make-path-to-polkit-agent-helper-1-binary-configura.patch b/debian/patches/build-make-path-to-polkit-agent-helper-1-binary-configura.patch new file mode 100644 index 00000000..03f2bc80 --- /dev/null +++ b/debian/patches/build-make-path-to-polkit-agent-helper-1-binary-configura.patch @@ -0,0 +1,169 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Fri, 12 Feb 2021 10:17:41 +0100 +Subject: build: make path to polkit-agent-helper-1 binary configurable + +Add new configure option to set the path to "polkit-agent-helper-1". + +The path cannot be obtained from pkg-config and `pkg-config +--variable=prefix polkit-agent-1` is not good enough. + +On Fedora, the path is "/usr/lib/polkit-1/polkit-agent-helper-1". +On Debian Buster, the path is "/usr/lib/policykit-1/polkit-agent-helper-1" +On Debian Sid, the path is "/usr/libexec/polkit-agent-helper-1" (but +currently it is also symlinked from "/usr/lib/policykit-1/polkit-agent-helper-1". + +(cherry picked from commit 801c41a11c2cd37dc1271c026edc0a3292cc69b8) +--- + NEWS | 1 + + clients/common/nm-polkit-listener.c | 2 +- + config.h.meson | 6 +++--- + configure.ac | 28 +++++++++++++++++++--------- + meson.build | 17 ++++++++++++----- + meson_options.txt | 2 +- + 6 files changed, 37 insertions(+), 19 deletions(-) + +diff --git a/NEWS b/NEWS +index 5ba8533..0946800 100644 +--- a/NEWS ++++ b/NEWS +@@ -28,6 +28,7 @@ USE AT YOUR OWN RISK. NOT RECOMMENDED FOR PRODUCTION USE! + * initrd: support new ip method "link6" for IPv6 link-local only. + * ci: use ci-templates for containers on gitlab-ci. + * ci: test build against Alpine Linux on gitlab-ci. ++* build: new configure option to set path to "polkit-agent-helper-1". + * Many bugfixes and improvements. + + ============================================= +diff --git a/clients/common/nm-polkit-listener.c b/clients/common/nm-polkit-listener.c +index db21abf..357e1ef 100644 +--- a/clients/common/nm-polkit-listener.c ++++ b/clients/common/nm-polkit-listener.c +@@ -501,7 +501,7 @@ begin_authentication(AuthRequest *request) + { + int fd_flags; + const char *helper_argv[] = { +- POLKIT_PACKAGE_PREFIX "/lib/polkit-1/polkit-agent-helper-1", ++ POLKIT_AGENT_HELPER_1_PATH, + request->username, + NULL, + }; +diff --git a/config.h.meson b/config.h.meson +index bb5458a..a911dbe 100644 +--- a/config.h.meson ++++ b/config.h.meson +@@ -109,6 +109,9 @@ + /* Define to the full name and version of this package. */ + #mesondefine PACKAGE_STRING + ++/* path to polkit-agent-helper-1 binary */ ++#mesondefine POLKIT_AGENT_HELPER_1_PATH ++ + /* Path to resolvconf */ + #mesondefine RESOLVCONF_PATH + +@@ -218,9 +221,6 @@ + /* Define if you have oFono support (experimental) */ + #mesondefine WITH_OFONO + +-/* Define the polkit agent package prefix */ +-#mesondefine POLKIT_PACKAGE_PREFIX +- + /* Define if you have PPP support */ + #mesondefine WITH_PPP + +diff --git a/configure.ac b/configure.ac +index 98c2259..5e7d67c 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -642,16 +642,25 @@ fi + AC_DEFINE_UNQUOTED(NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT, "$enable_polkit", [The default value of the auth-polkit configuration option]) + AC_SUBST(NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT_TEXT, "$enable_polkit") + +-PKG_CHECK_MODULES(POLKIT, [polkit-agent-1 >= 0.97], [have_pk_agent=yes],[have_pk_agent=no]) +-if test x"$have_pk_agent" = x"no"; then +- POLKIT_PACKAGE_PREFIX="/usr" +-else +- POLKIT_PACKAGE_PREFIX=`$PKG_CONFIG --variable=prefix polkit-agent-1` ++AC_ARG_WITH([polkit-agent-helper-1-path], ++ AS_HELP_STRING([--with-polkit-agent-helper-1-path=PATH], ++ [Path name to the polkit-agent-helper-1 binary from polkit]), ++ POLKIT_AGENT_HELPER_1_PATH="$withval", ++ POLKIT_AGENT_HELPER_1_PATH="") ++if test -z "$POLKIT_AGENT_HELPER_1_PATH" ; then ++ for p in /usr/libexec/polkit-agent-helper-1 \ ++ /usr/lib/polkit-1/polkit-agent-helper-1 \ ++ /usr/lib/policykit-1/polkit-agent-helper-1 ; do ++ if test -f "$p" ; then ++ POLKIT_AGENT_HELPER_1_PATH="$p" ++ break ++ fi ++ done + fi +-AC_DEFINE_UNQUOTED([POLKIT_PACKAGE_PREFIX], +- ["$POLKIT_PACKAGE_PREFIX"], +- [polkit-agent package prefix]) +- ++test -z "$POLKIT_AGENT_HELPER_1_PATH" && POLKIT_AGENT_HELPER_1_PATH=/usr/lib/polkit-1/polkit-agent-helper-1 ++AC_DEFINE_UNQUOTED([POLKIT_AGENT_HELPER_1_PATH], ++ ["$POLKIT_AGENT_HELPER_1_PATH"], ++ [path to polkit-agent-helper-1 binary]) + + AC_ARG_ENABLE(modify-system, AS_HELP_STRING([--enable-modify-system], [Allow users to modify system connections])) + if test "${enable_modify_system}" = "yes"; then +@@ -1332,6 +1341,7 @@ if test "${enable_modify_system}" = "yes"; then + else + echo " policykit: main.auth-polkit=${enable_polkit} (restrictive modify.system)" + fi ++echo " polkit-agent-helper-1: $POLKIT_AGENT_HELPER_1_PATH" + echo " selinux: $have_selinux" + echo " systemd-journald: $have_systemd_journal (default: logging.backend=${nm_config_logging_backend_default})" + echo " hostname persist: ${hostname_persist}" +diff --git a/meson.build b/meson.build +index 594fa63..bf6055b 100644 +--- a/meson.build ++++ b/meson.build +@@ -514,12 +514,18 @@ config_h.set_quoted('NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT', config_auth_polkit_def + + enable_modify_system = get_option('modify_system') + +-polkit_agent_dep = dependency('polkit-agent-1', version: '>= 0.97', required : false) +-if polkit_agent_dep.found() +- config_h.set_quoted('POLKIT_PACKAGE_PREFIX', polkit_agent_dep.get_pkgconfig_variable('prefix')) +-else +- config_h.set_quoted('POLKIT_PACKAGE_PREFIX', '/usr') ++polkit_agent_helper_1_path = get_option('polkit_agent_helper_1_path') ++foreach p : [ '/usr/libexec/polkit-agent-helper-1', ++ '/usr/lib/polkit-1/polkit-agent-helper-1', ++ '/usr/lib/policykit-1/polkit-agent-helper-1' ] ++ if polkit_agent_helper_1_path == '' and run_command('test', '-f', p).returncode() == 0 ++ polkit_agent_helper_1_path = p ++ endif ++endforeach ++if polkit_agent_helper_1_path == '' ++ polkit_agent_helper_1_path = '/usr/lib/polkit-1/polkit-agent-helper-1' + endif ++config_h.set_quoted('POLKIT_AGENT_HELPER_1_PATH', polkit_agent_helper_1_path) + + + crypto = get_option('crypto') +@@ -1016,6 +1022,7 @@ if enable_polkit + output += ' modify.system)' + endif + output += '\n' ++output += ' polkit-agent-helper-1: ' + polkit_agent_helper_1_path + '\n' + output += ' selinux: ' + enable_selinux.to_string() + '\n' + output += ' systemd-journald: ' + enable_systemd_journal.to_string() + ' (default: logging.backend=' + config_logging_backend_default + ')\n' + output += ' hostname persist: ' + hostname_persist + '\n' +diff --git a/meson_options.txt b/meson_options.txt +index d4f6282..71de320 100644 +--- a/meson_options.txt ++++ b/meson_options.txt +@@ -16,7 +16,7 @@ option('suspend_resume', type: 'combo', choices: ['upower', 'systemd', 'elogind' + option('polkit', type: 'boolean', value: true, description: 'User auth-polkit configuration option.') + option('config_auth_polkit_default', type: 'combo', choices: ['default', 'true', 'false', 'root-only'], value: 'default', description: 'Default value for configuration main.auth-polkit.') + option('modify_system', type: 'boolean', value: false, description: 'Allow users to modify system connections') +-option('polkit_agent', type: 'boolean', value: false, description: 'enable polkit agent for clients') ++option('polkit_agent_helper_1_path', type: 'string', value: '', description: 'Path name to the polkit-agent-helper-1 binary from polkit') + option('selinux', type: 'boolean', value: true, description: 'Build with SELinux') + option('systemd_journal', type: 'boolean', value: true, description: 'Use systemd journal for logging') + option('config_logging_backend_default', type: 'combo', choices: ['default', 'syslog', 'journal'], value: 'default', description: 'Default value for logging.backend') diff --git a/debian/patches/build-rename-build-option-with-polkit-agent-helper-1-path.patch b/debian/patches/build-rename-build-option-with-polkit-agent-helper-1-path.patch new file mode 100644 index 00000000..6693f3cb --- /dev/null +++ b/debian/patches/build-rename-build-option-with-polkit-agent-helper-1-path.patch @@ -0,0 +1,75 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Tue, 16 Feb 2021 21:33:30 +0100 +Subject: build: rename build option "--with-polkit-agent-helper-1{-path,}" + +Suggested-by: Michael Biebl <biebl@debian.org> +(cherry picked from commit d9968b133b32fbfbc5e726a8fc96e38cc044c831) +--- + configure.ac | 9 ++++++--- + meson.build | 5 ++++- + meson_options.txt | 2 +- + 3 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 5e7d67c..9d37ce6 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -642,9 +642,9 @@ fi + AC_DEFINE_UNQUOTED(NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT, "$enable_polkit", [The default value of the auth-polkit configuration option]) + AC_SUBST(NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT_TEXT, "$enable_polkit") + +-AC_ARG_WITH([polkit-agent-helper-1-path], +- AS_HELP_STRING([--with-polkit-agent-helper-1-path=PATH], +- [Path name to the polkit-agent-helper-1 binary from polkit]), ++AC_ARG_WITH([polkit-agent-helper-1], ++ AS_HELP_STRING([--with-polkit-agent-helper-1=/path/to/polkit-agent-helper-1], ++ [Path to the polkit-agent-helper-1 binary from polkit]), + POLKIT_AGENT_HELPER_1_PATH="$withval", + POLKIT_AGENT_HELPER_1_PATH="") + if test -z "$POLKIT_AGENT_HELPER_1_PATH" ; then +@@ -658,6 +658,9 @@ if test -z "$POLKIT_AGENT_HELPER_1_PATH" ; then + done + fi + test -z "$POLKIT_AGENT_HELPER_1_PATH" && POLKIT_AGENT_HELPER_1_PATH=/usr/lib/polkit-1/polkit-agent-helper-1 ++if test "$POLKIT_AGENT_HELPER_1_PATH" = "${POLKIT_AGENT_HELPER_1_PATH#/}" ; then ++ AC_MSG_ERROR(["polkit_agent_helper_1 must be an absolute path, but is '$POLKIT_AGENT_HELPER_1_PATH'"]) ++fi + AC_DEFINE_UNQUOTED([POLKIT_AGENT_HELPER_1_PATH], + ["$POLKIT_AGENT_HELPER_1_PATH"], + [path to polkit-agent-helper-1 binary]) +diff --git a/meson.build b/meson.build +index bf6055b..1bfe202 100644 +--- a/meson.build ++++ b/meson.build +@@ -514,7 +514,7 @@ config_h.set_quoted('NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT', config_auth_polkit_def + + enable_modify_system = get_option('modify_system') + +-polkit_agent_helper_1_path = get_option('polkit_agent_helper_1_path') ++polkit_agent_helper_1_path = get_option('polkit_agent_helper_1') + foreach p : [ '/usr/libexec/polkit-agent-helper-1', + '/usr/lib/polkit-1/polkit-agent-helper-1', + '/usr/lib/policykit-1/polkit-agent-helper-1' ] +@@ -525,6 +525,9 @@ endforeach + if polkit_agent_helper_1_path == '' + polkit_agent_helper_1_path = '/usr/lib/polkit-1/polkit-agent-helper-1' + endif ++if polkit_agent_helper_1_path[0] != '/' ++ error('polkit_agent_helper_1 must be an absolute path, but is ' + polkit_agent_helper_1_path) ++endif + config_h.set_quoted('POLKIT_AGENT_HELPER_1_PATH', polkit_agent_helper_1_path) + + +diff --git a/meson_options.txt b/meson_options.txt +index 71de320..5100ed7 100644 +--- a/meson_options.txt ++++ b/meson_options.txt +@@ -16,7 +16,7 @@ option('suspend_resume', type: 'combo', choices: ['upower', 'systemd', 'elogind' + option('polkit', type: 'boolean', value: true, description: 'User auth-polkit configuration option.') + option('config_auth_polkit_default', type: 'combo', choices: ['default', 'true', 'false', 'root-only'], value: 'default', description: 'Default value for configuration main.auth-polkit.') + option('modify_system', type: 'boolean', value: false, description: 'Allow users to modify system connections') +-option('polkit_agent_helper_1_path', type: 'string', value: '', description: 'Path name to the polkit-agent-helper-1 binary from polkit') ++option('polkit_agent_helper_1', type: 'string', value: '', description: 'Path name to the polkit-agent-helper-1 binary from polkit') + option('selinux', type: 'boolean', value: true, description: 'Build with SELinux') + option('systemd_journal', type: 'boolean', value: true, description: 'Use systemd journal for logging') + option('config_logging_backend_default', type: 'combo', choices: ['default', 'syslog', 'journal'], value: 'default', description: 'Default value for logging.backend') diff --git a/debian/patches/iwd-Fix-the-leaks-in-get_agent_request_network_path.patch b/debian/patches/iwd-Fix-the-leaks-in-get_agent_request_network_path.patch new file mode 100644 index 00000000..31e60ae1 --- /dev/null +++ b/debian/patches/iwd-Fix-the-leaks-in-get_agent_request_network_path.patch @@ -0,0 +1,38 @@ +From: Andrew Zaborowski <andrew.zaborowski@intel.com> +Date: Fri, 12 Feb 2021 11:04:26 +0100 +Subject: iwd: Fix the leaks in get_agent_request_network_path + +Don't request new copies of strings from g_variant_get() to avoid +leaking memory as pointed out by Thomas Haller. + +Fixes: dc0e31fb7014 ('iwd: Add the wifi.iwd.autoconnect setting') +(cherry picked from commit 5ccb8ce17a161fa7e926a1644a4c1aadbf74c002) +--- + src/core/devices/wifi/nm-device-iwd.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/src/core/devices/wifi/nm-device-iwd.c b/src/core/devices/wifi/nm-device-iwd.c +index f0de90d..95ade44 100644 +--- a/src/core/devices/wifi/nm-device-iwd.c ++++ b/src/core/devices/wifi/nm-device-iwd.c +@@ -1282,15 +1282,13 @@ get_agent_request_network_path(GDBusMethodInvocation *invocation) + const char *network_path = NULL; + + if (nm_streq(method_name, "RequestPassphrase")) +- g_variant_get(params, "(o)", &network_path); ++ g_variant_get(params, "(&o)", &network_path); + else if (nm_streq(method_name, "RequestPrivateKeyPassphrase")) +- g_variant_get(params, "(o)", &network_path); ++ g_variant_get(params, "(&o)", &network_path); + else if (nm_streq(method_name, "RequestUserNameAndPassword")) +- g_variant_get(params, "(o)", &network_path); +- else if (nm_streq(method_name, "RequestUserPassword")) { +- const char *user; +- g_variant_get(params, "(os)", &network_path, &user); +- } ++ g_variant_get(params, "(&o)", &network_path); ++ else if (nm_streq(method_name, "RequestUserPassword")) ++ g_variant_get(params, "(&os)", &network_path, NULL); + + return network_path; + } diff --git a/debian/patches/libnm-add-assertion-in-_dbus_handle_properties_changed.patch b/debian/patches/libnm-add-assertion-in-_dbus_handle_properties_changed.patch new file mode 100644 index 00000000..1cfefd48 --- /dev/null +++ b/debian/patches/libnm-add-assertion-in-_dbus_handle_properties_changed.patch @@ -0,0 +1,21 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Mon, 15 Feb 2021 09:59:53 +0100 +Subject: libnm: add assertion in _dbus_handle_properties_changed() + +(cherry picked from commit 3ceec9c6ac399b849fcabc52cf58e9001a6b8684) +--- + libnm/nm-client.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libnm/nm-client.c b/libnm/nm-client.c +index 92ad5ef..f1b2597 100644 +--- a/libnm/nm-client.c ++++ b/libnm/nm-client.c +@@ -2959,6 +2959,7 @@ _dbus_handle_properties_changed(NMClient * self, + dbobj = _dbobjs_dbobj_create(self, g_steal_pointer(&dbus_path)); + nml_dbus_object_set_obj_state(dbobj, NML_DBUS_OBJ_STATE_ON_DBUS, self); + db_iface_data = nml_dbus_object_iface_data_get(dbobj, interface_name, TRUE); ++ nm_assert(db_iface_data); + } + + NM_SET_OUT(inout_dbobj, dbobj); diff --git a/debian/patches/libnm-avoid-assertion-failure-in-_dbus_handle_properties_.patch b/debian/patches/libnm-avoid-assertion-failure-in-_dbus_handle_properties_.patch new file mode 100644 index 00000000..e6f9209a --- /dev/null +++ b/debian/patches/libnm-avoid-assertion-failure-in-_dbus_handle_properties_.patch @@ -0,0 +1,32 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Mon, 15 Feb 2021 09:11:42 +0100 +Subject: libnm: avoid assertion failure in _dbus_handle_properties_changed() + for logging no properties + +(cherry picked from commit 1f9622358a691aa97b72b3df118feac7970769c4) +--- + libnm/nm-client.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/libnm/nm-client.c b/libnm/nm-client.c +index 2c77519..ec79b40 100644 +--- a/libnm/nm-client.c ++++ b/libnm/nm-client.c +@@ -2930,11 +2930,15 @@ _dbus_handle_properties_changed(NMClient * self, + gs_free char *ss = NULL; + + NML_NMCLIENT_LOG_T(self, +- "[%s]: %s: properties changed for interface %s { %s }", ++ "[%s]: %s: properties changed for interface %s %s%s%s", + object_path, + log_context, + interface_name, +- (ss = g_variant_print(changed_properties, TRUE))); ++ NM_PRINT_FMT_QUOTED(changed_properties, ++ "{ ", ++ (ss = g_variant_print(changed_properties, TRUE)), ++ " }", ++ "(no changed properties)")); + } + + if (inout_dbobj) { diff --git a/debian/patches/libnm-fix-tracking-object-state-in-NMClient-cache.patch b/debian/patches/libnm-fix-tracking-object-state-in-NMClient-cache.patch new file mode 100644 index 00000000..722e7fef --- /dev/null +++ b/debian/patches/libnm-fix-tracking-object-state-in-NMClient-cache.patch @@ -0,0 +1,102 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Mon, 15 Feb 2021 09:17:07 +0100 +Subject: libnm: fix tracking object state in NMClient cache + +NMClient has a NMLDBusObject instance for each D-Bus object +that it sees. This object can be in different states, like that we +already saw it on D-Bus or that it is only referred to by another +property. Due to a bug, we would wrongly not update the state and +trigger an assertion. + +Reproduce with python-dbusmock (commit e89e28bf1bc0254a1eb71b71cf68ef7a97d11e5b) +by running `pytest -v -s tests/test_networkmanager.py -k test_one_wifi_with_accesspoints`. +With LIBNM_CLIENT_DEBUG we get: + +>>> libnm-dbus[96085]: <trace> [6464.06459] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: properties-changed: properties changed for interface org.freedesktop.NetworkManager.Device { {'ActiveConnection': <objectpath '/org/freedesktop/NetworkManager/ActiveConnection/0'>} } + libnm-dbus[96085]: <trace> [6464.06459] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: properties-changed: set property org.freedesktop.NetworkManager.Device.ActiveConnection + libnm-dbus[96085]: <trace> [6464.06459] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x01 linked + libnm-dbus[96085]: <trace> [6464.06459] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x01 consumed +>>> libnm-dbus[96085]: <trace> [6464.06459] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: set D-Bus object state watched-only + libnm-dbus[96085]: <trace> [6464.06459] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x02 linked + libnm-dbus[96085]: <trace> [6464.06459] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager]: changed-type 0x02 linked + libnm-dbus[96085]: <trace> [6464.06459] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x02 consumed +>>> libnm-dbus[96085]: <error> [6464.06459] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: property ActiveConnection references /org/freedesktop/NetworkManager/ActiveConnection/0 but object is not present on D-Bus + libnm-dbus[96085]: <trace> [6464.06459] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager]: changed-type 0x02 consumed + libnm-dbus[96085]: <trace> [6464.06460] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: properties-changed: properties changed for interface org.freedesktop.NetworkManager.Device { {'State': <uint32 100>} } + libnm-dbus[96085]: <trace> [6464.06460] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: properties-changed: set property org.freedesktop.NetworkManager.Device.State + libnm-dbus[96085]: <trace> [6464.06460] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x01 linked + libnm-dbus[96085]: <trace> [6464.06460] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x01 consumed + libnm-dbus[96085]: <trace> [6464.06460] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x02 linked + libnm-dbus[96085]: <trace> [6464.06460] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager]: changed-type 0x02 linked + libnm-dbus[96085]: <trace> [6464.06461] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x02 consumed + libnm-dbus[96085]: <trace> [6464.06461] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager]: changed-type 0x02 consumed + libnm-dbus[96085]: <trace> [6464.06462] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: properties-changed: properties changed for interface org.freedesktop.NetworkManager.Device { {'StateReason': <(uint32 100, uint32 0)>} } + libnm-dbus[96085]: <trace> [6464.06462] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: properties-changed: set property org.freedesktop.NetworkManager.Device.StateReason + libnm-dbus[96085]: <trace> [6464.06462] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x01 linked + libnm-dbus[96085]: <trace> [6464.06462] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x01 consumed + libnm-dbus[96085]: <trace> [6464.06462] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x02 linked + libnm-dbus[96085]: <trace> [6464.06462] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager]: changed-type 0x02 linked + libnm-dbus[96085]: <trace> [6464.06462] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/Devices/mock_WiFi2]: changed-type 0x02 consumed + libnm-dbus[96085]: <trace> [6464.06462] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager]: changed-type 0x02 consumed +>>> libnm-dbus[96085]: <trace> [6464.06465] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: properties changed for interface org.freedesktop.NetworkManager.Connection.Active { {'Devices': <[objectpath '/org/freedesktop/NetworkManager/Devices/mock_WiFi2']>, 'Default6': <false>, 'Default': <true>, 'Type': <'802-11-wireless'>, 'Vpn': <false>, 'Connection': <objectpath '/org/freedesktop/NetworkManager/Settings/Mock_AP3'>, 'Master': <objectpath '/'>, 'SpecificObject': <objectpath '/org/freedesktop/NetworkManager/AccessPoint/Mock_AP3'>, 'Uuid': <'72757a57-8cb6-4052-a18f-4e2be4ba27d9'>, 'State': <uint32 2>, 'Id': <'AP_3'>} } +>>> here we lack "set D-Bus object state on-dbus" + libnm-dbus[96085]: <trace> [6464.06465] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.Devices + libnm-dbus[96085]: <trace> [6464.06465] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.Default6 + libnm-dbus[96085]: <trace> [6464.06465] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.Default + libnm-dbus[96085]: <trace> [6464.06465] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.Type + libnm-dbus[96085]: <trace> [6464.06465] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.Vpn + libnm-dbus[96085]: <trace> [6464.06465] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.Connection + libnm-dbus[96085]: <trace> [6464.06465] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.Master + libnm-dbus[96085]: <trace> [6464.06465] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.SpecificObject + libnm-dbus[96085]: <trace> [6464.06466] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.Uuid + libnm-dbus[96085]: <trace> [6464.06466] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.State + libnm-dbus[96085]: <trace> [6464.06466] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: interfaces-added: set property org.freedesktop.NetworkManager.Connection.Active.Id + libnm-dbus[96085]: <trace> [6464.06466] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: changed-type 0x01 linked + libnm-dbus[96085]: <trace> [6464.06466] nmclient[c9bf1eaa1f4b6c99]: [/org/freedesktop/NetworkManager/ActiveConnection/0]: changed-type 0x01 consumed + Bail out! libnm:ERROR:libnm/nm-client.c:2863:_dbus_handle_obj_changed_dbus: assertion failed: (dbobj->obj_state >= NML_DBUS_OBJ_STATE_ON_DBUS) + +Backtrace: + + #3 0x00007f0bd11173bf in g_assertion_message_expr + (domain=domain@entry=0x7f0bd1576018 "libnm", file=file@entry=0x7f0bd1576006 "libnm/nm-client.c", line=line@entry=2863, func=func@entry=0x7f0bd157f1b0 <__func__.170> "_dbus_handle_obj_changed_dbus", expr=expr@entry=0x7f0bd157cba0 "dbobj->obj_state >= NML_DBUS_OBJ_STATE_ON_DBUS") at ../glib/gtestutils.c:2963 + #4 0x00007f0bd14959dd in _dbus_handle_obj_changed_dbus (self=self@entry=0x5612d4f5a130, log_context=<optimized out>) at libnm/nm-client.c:2863 + #5 0x00007f0bd1495c29 in _dbus_handle_changes (self=self@entry=0x5612d4f5a130, log_context=<optimized out>, allow_init_start_check_complete=allow_init_start_check_complete@entry=1) + at libnm/nm-client.c:2909 + #6 0x00007f0bd1497e56 in _dbus_managed_objects_changed_cb + (connection=<optimized out>, sender_name=<optimized out>, arg_object_path=<optimized out>, interface_name=<optimized out>, signal_name=<optimized out>, parameters=0x7f0bb800d720, user_data=0x5612d4f5a130) at libnm/nm-client.c:3172 + #7 0x00007f0bd132a8df in emit_signal_instance_in_idle_cb (data=data@entry=0x7f0bb8003700) at ../gio/gdbusconnection.c:3789 + #8 0x00007f0bd10f1b5b in g_idle_dispatch (source=source@entry=0x7f0bb8012260, callback=0x7f0bd132a860 <emit_signal_instance_in_idle_cb>, user_data=0x7f0bb8003700) at ../glib/gmain.c:5836 + #9 0x00007f0bd10f2a9f in g_main_dispatch (context=0x5612d4f4b630) at ../glib/gmain.c:3325 + #10 g_main_context_dispatch (context=0x5612d4f4b630) at ../glib/gmain.c:4043 + #11 0x00007f0bd1144a98 in g_main_context_iterate.constprop.0 (context=0x5612d4f4b630, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4119 + #12 0x00007f0bd10f2163 in g_main_loop_run (loop=0x5612d4f4b720) at ../glib/gmain.c:4317 + #13 0x00005612d44b6543 in main (argc=7, argv=0x7fff4414f1d8) at clients/cli/nmcli.c:1036 + +https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982613 +https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/662 + +Fixes: ce0e898fb476 ('libnm: refactor caching of D-Bus objects in NMClient') +(cherry picked from commit e1e9abdf041b4cc95fb1936b75ced7669f3d7867) +--- + libnm/nm-client.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/libnm/nm-client.c b/libnm/nm-client.c +index ec79b40..92ad5ef 100644 +--- a/libnm/nm-client.c ++++ b/libnm/nm-client.c +@@ -2950,9 +2950,12 @@ _dbus_handle_properties_changed(NMClient * self, + dbobj = _dbobjs_dbobj_get_r(self, dbus_path); + } + +- if (dbobj) ++ if (dbobj) { ++ nm_assert(dbobj->obj_state >= NML_DBUS_OBJ_STATE_WATCHED_ONLY); + db_iface_data = nml_dbus_object_iface_data_get(dbobj, interface_name, allow_add_iface); +- else if (allow_add_iface) { ++ if (db_iface_data && dbobj->obj_state == NML_DBUS_OBJ_STATE_WATCHED_ONLY) ++ nml_dbus_object_set_obj_state(dbobj, NML_DBUS_OBJ_STATE_ON_DBUS, self); ++ } else if (allow_add_iface) { + dbobj = _dbobjs_dbobj_create(self, g_steal_pointer(&dbus_path)); + nml_dbus_object_set_obj_state(dbobj, NML_DBUS_OBJ_STATE_ON_DBUS, self); + db_iface_data = nml_dbus_object_iface_data_get(dbobj, interface_name, TRUE); diff --git a/debian/patches/libnm-log-PID-in-LIBNM_CLIENT_DEBUG-debug-logging.patch b/debian/patches/libnm-log-PID-in-LIBNM_CLIENT_DEBUG-debug-logging.patch new file mode 100644 index 00000000..cf932651 --- /dev/null +++ b/debian/patches/libnm-log-PID-in-LIBNM_CLIENT_DEBUG-debug-logging.patch @@ -0,0 +1,42 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Mon, 15 Feb 2021 08:47:16 +0100 +Subject: libnm: log PID in LIBNM_CLIENT_DEBUG debug logging + +(cherry picked from commit 6da5fc59d860913a278f488f0873ce68f038de2b) +--- + libnm/nm-libnm-utils.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/libnm/nm-libnm-utils.c b/libnm/nm-libnm-utils.c +index 1fb6a47..1000e04 100644 +--- a/libnm/nm-libnm-utils.c ++++ b/libnm/nm-libnm-utils.c +@@ -46,6 +46,7 @@ _nml_dbus_log(NMLDBusLogLevel level, gboolean use_stdout, const char *fmt, ...) + va_list args; + const char * prefix = ""; + gint64 ts; ++ pid_t pid; + + /* we only call _nml_dbus_log() after nml_dbus_log_enabled(), which already does + * an atomic access to the variable. Since the value is only initialized once and +@@ -89,14 +90,18 @@ _nml_dbus_log(NMLDBusLogLevel level, gboolean use_stdout, const char *fmt, ...) + + ts = nm_utils_clock_gettime_nsec(CLOCK_BOOTTIME); + ++ pid = getpid(); ++ + if (use_stdout) { +- g_print("libnm-dbus: %s[%" G_GINT64_FORMAT ".%05" G_GINT64_FORMAT "] %s\n", ++ g_print("libnm-dbus[%lld]: %s[%" G_GINT64_FORMAT ".%05" G_GINT64_FORMAT "] %s\n", ++ (long long) pid, + prefix, + ts / NM_UTILS_NSEC_PER_SEC, + (ts / (NM_UTILS_NSEC_PER_SEC / 10000)) % 10000, + msg); + } else { +- g_printerr("libnm-dbus: %s[%" G_GINT64_FORMAT ".%05" G_GINT64_FORMAT "] %s\n", ++ g_printerr("libnm-dbus[%lld]: %s[%" G_GINT64_FORMAT ".%05" G_GINT64_FORMAT "] %s\n", ++ (long long) pid, + prefix, + ts / NM_UTILS_NSEC_PER_SEC, + (ts / (NM_UTILS_NSEC_PER_SEC / 10000)) % 10000, diff --git a/debian/patches/platform-downgrade-severity-of-message-for-failure-to-cre.patch b/debian/patches/platform-downgrade-severity-of-message-for-failure-to-cre.patch new file mode 100644 index 00000000..c6acda06 --- /dev/null +++ b/debian/patches/platform-downgrade-severity-of-message-for-failure-to-cre.patch @@ -0,0 +1,37 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Mon, 15 Feb 2021 20:52:55 +0100 +Subject: platform: downgrade severity of message for failure to create + NMPNetns + +Under restricted permissions (like inside a podman container) opening +"/proc/self/ns/net" fails with Permission denied. Consequently we cannot +create our bottom NMPNetns instance. That is mostly fine, however we +would log an error message with severity <error>. + +Note that test "src/core/platform/tests/test-platform-general" asserts +that no <warn> and <error> messages get logged. Hence, the test will +fail. + +That is undesirable. Downgrade the message to <debug> so that the test +passes. Also, it's not clear that this error message is useful here. +Being unable to open a netns fd is fine and not necessarily an error +condition. + +(cherry picked from commit 0213300dcee438a0b48a3d3a6da3112286ad43d1) +--- + shared/nm-platform/nmp-netns.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/shared/nm-platform/nmp-netns.c b/shared/nm-platform/nmp-netns.c +index 0828f4a..f97339a75 100644 +--- a/shared/nm-platform/nmp-netns.c ++++ b/shared/nm-platform/nmp-netns.c +@@ -171,7 +171,7 @@ _netns_stack_get_impl(void) + netns = _netns_new(&error); + + if (!netns) { +- _LOGE(NULL, "failed to create initial netns: %s", error->message); ++ _LOGD(NULL, "failed to create initial netns: %s", error->message); + return s; + } + diff --git a/debian/patches/platform-ensure-NM_SOCK_ADDR_UNION_INIT_UNSPEC-fully-init.patch b/debian/patches/platform-ensure-NM_SOCK_ADDR_UNION_INIT_UNSPEC-fully-init.patch new file mode 100644 index 00000000..be47404a --- /dev/null +++ b/debian/patches/platform-ensure-NM_SOCK_ADDR_UNION_INIT_UNSPEC-fully-init.patch @@ -0,0 +1,35 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Sat, 13 Feb 2021 15:45:44 +0100 +Subject: platform: ensure NM_SOCK_ADDR_UNION_INIT_UNSPEC() fully initializes + union + +In C, initialization of a union does not define that excess memory +is initialized. Ensure that, by initializing the largest member of the +NMSockAddrUnion union. + +(cherry picked from commit 7bf2ddf73f8d8c2d882c4932e88b76eef337cd0a) +--- + src/core/platform/nmp-object.h | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/src/core/platform/nmp-object.h b/src/core/platform/nmp-object.h +index dc2cc86..19f6bcd 100644 +--- a/src/core/platform/nmp-object.h ++++ b/src/core/platform/nmp-object.h +@@ -34,10 +34,14 @@ typedef union { + struct sockaddr_in6 in6; + } NMSockAddrUnion; + ++G_STATIC_ASSERT(sizeof(NMSockAddrUnion) == sizeof(((NMSockAddrUnion *) NULL)->in6)); ++ ++/* we initialize the largest union member, to ensure that all fields are initialized. */ ++ + #define NM_SOCK_ADDR_UNION_INIT_UNSPEC \ + { \ +- .sa = { \ +- .sa_family = AF_UNSPEC, \ ++ .in6 = { \ ++ .sin6_family = AF_UNSPEC, \ + }, \ + } + diff --git a/debian/patches/platform-reorder-code-in-_netns_stack_get_impl.patch b/debian/patches/platform-reorder-code-in-_netns_stack_get_impl.patch new file mode 100644 index 00000000..d68983af --- /dev/null +++ b/debian/patches/platform-reorder-code-in-_netns_stack_get_impl.patch @@ -0,0 +1,51 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Mon, 15 Feb 2021 20:45:21 +0100 +Subject: platform: reorder code in _netns_stack_get_impl() + +We should always register the GArray stack with pthread +for cleanup the thread local storage. Do that first, before +creating the NMPNetns instance at the bottom of the stack. + +(cherry picked from commit f9636080ace7d7834083dcb1a3300e08368ee4eb) +--- + shared/nm-platform/nmp-netns.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/shared/nm-platform/nmp-netns.c b/shared/nm-platform/nmp-netns.c +index c7cb617..0828f4a 100644 +--- a/shared/nm-platform/nmp-netns.c ++++ b/shared/nm-platform/nmp-netns.c +@@ -158,9 +158,18 @@ _netns_stack_get_impl(void) + g_array_set_clear_func(s, _netns_stack_clear_cb); + _netns_stack = s; + ++ /* register a destructor function to cleanup the array. If we fail ++ * to do so, we will leak NMPNetns instances (and their file descriptor) when the ++ * thread exits. */ ++ if (pthread_key_create(&key, (void (*)(void *)) g_array_unref) != 0) ++ _LOGE(NULL, "failure to initialize thread-local storage"); ++ else if (pthread_setspecific(key, s) != 0) ++ _LOGE(NULL, "failure to set thread-local storage"); ++ + /* at the bottom of the stack we must try to create a netns instance + * that we never pop. It's the base to which we need to return. */ + netns = _netns_new(&error); ++ + if (!netns) { + _LOGE(NULL, "failed to create initial netns: %s", error->message); + return s; +@@ -169,14 +178,6 @@ _netns_stack_get_impl(void) + /* we leak this instance inside the stack. */ + _stack_push(s, netns, _CLONE_NS_ALL); + +- /* finally, register a destructor function to cleanup the array. If we fail +- * to do so, we will leak NMPNetns instances (and their file descriptor) when the +- * thread exits. */ +- if (pthread_key_create(&key, (void (*)(void *)) g_array_unref) != 0) +- _LOGE(NULL, "failure to initialize thread-local storage"); +- else if (pthread_setspecific(key, s) != 0) +- _LOGE(NULL, "failure to set thread-local storage"); +- + return s; + } + diff --git a/debian/patches/platform-tests-skip-tests-if-unshare-CLONE_NEWNET-CLONE_N.patch b/debian/patches/platform-tests-skip-tests-if-unshare-CLONE_NEWNET-CLONE_N.patch new file mode 100644 index 00000000..027f4f32 --- /dev/null +++ b/debian/patches/platform-tests-skip-tests-if-unshare-CLONE_NEWNET-CLONE_N.patch @@ -0,0 +1,42 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Mon, 15 Feb 2021 20:36:53 +0100 +Subject: platform/tests: skip tests if "unshare(CLONE_NEWNET|CLONE_NEWNS)" + fails + +Inside a podman container (without `--priviledged`) we don't have +permissions for "unshare(CLONE_NEWNET|CLONE_NEWNS)". + +It's not useful to fail tests in environments where they cannot run. +Skip them. + +(cherry picked from commit ecdbb1ab8458b7a373038a2abd8cabd56e664ceb) +--- + src/core/platform/tests/test-common.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/src/core/platform/tests/test-common.c b/src/core/platform/tests/test-common.c +index 87e5329..4a117d5 100644 +--- a/src/core/platform/tests/test-common.c ++++ b/src/core/platform/tests/test-common.c +@@ -2563,7 +2563,20 @@ main(int argc, char **argv) + + if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) { + errsv = errno; +- g_error("unshare(CLONE_NEWNET|CLONE_NEWNS) failed with %s (%d)", ++ if (errsv == EPERM) { ++#ifdef REQUIRE_ROOT_TESTS ++ g_print("Fail test: unshare(CLONE_NEWNET|CLONE_NEWNS) failed with %s (%d)\n", ++ nm_strerror_native(errsv), ++ errsv); ++ return EXIT_FAILURE; ++#else ++ g_print("Skipping test: unshare(CLONE_NEWNET|CLONE_NEWNS) failed with %s (%d)\n", ++ nm_strerror_native(errsv), ++ errsv); ++ return g_test_run(); ++#endif ++ } ++ g_error("Fail test: unshare(CLONE_NEWNET|CLONE_NEWNS) failed with %s (%d)", + nm_strerror_native(errsv), + errsv); + } diff --git a/debian/patches/series b/debian/patches/series index 4a96b643..6ac615dc 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,15 @@ Force-online-state-with-unmanaged-devices.patch -Fix-polkit-agent-helper-1-path.patch +build-make-path-to-polkit-agent-helper-1-binary-configura.patch +iwd-Fix-the-leaks-in-get_agent_request_network_path.patch +libnm-log-PID-in-LIBNM_CLIENT_DEBUG-debug-logging.patch +libnm-avoid-assertion-failure-in-_dbus_handle_properties_.patch +libnm-fix-tracking-object-state-in-NMClient-cache.patch +libnm-add-assertion-in-_dbus_handle_properties_changed.patch +shared-refactor-nm_assert-for-NMRefString.patch +tests-add-bin-sbin-to-PATH-for-unit-tests.patch +platform-tests-skip-tests-if-unshare-CLONE_NEWNET-CLONE_N.patch +platform-reorder-code-in-_netns_stack_get_impl.patch +platform-downgrade-severity-of-message-for-failure-to-cre.patch +platform-ensure-NM_SOCK_ADDR_UNION_INIT_UNSPEC-fully-init.patch +wireguard-prefer-last-resolved-IP-from-resolving-endpoint.patch +build-rename-build-option-with-polkit-agent-helper-1-path.patch diff --git a/debian/patches/shared-refactor-nm_assert-for-NMRefString.patch b/debian/patches/shared-refactor-nm_assert-for-NMRefString.patch new file mode 100644 index 00000000..72d53614 --- /dev/null +++ b/debian/patches/shared-refactor-nm_assert-for-NMRefString.patch @@ -0,0 +1,54 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Mon, 15 Feb 2021 10:04:52 +0100 +Subject: shared: refactor nm_assert() for NMRefString + +- also check consistency of the string. + +- disable more expensive check unless running with NM_MORE_ASSERTS>10. + +(cherry picked from commit ac1c66eb343693cb63b8624b4be6088e1583670e) +--- + shared/nm-glib-aux/nm-ref-string.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/shared/nm-glib-aux/nm-ref-string.c b/shared/nm-glib-aux/nm-ref-string.c +index 902f1c8..1084c47 100644 +--- a/shared/nm-glib-aux/nm-ref-string.c ++++ b/shared/nm-glib-aux/nm-ref-string.c +@@ -49,20 +49,28 @@ _ref_string_equal(gconstpointer pa, gconstpointer pb) + static void + _ASSERT(const RefString *rstr0) + { +-#if NM_MORE_ASSERTS + int r; + + nm_assert(rstr0); + +- G_LOCK(gl_lock); +- r = g_atomic_int_get(&rstr0->ref_count); ++ if (NM_MORE_ASSERTS > 0) { ++ r = g_atomic_int_get(&rstr0->ref_count); ++ nm_assert(r > 0); ++ nm_assert(r < G_MAXINT); ++ } + +- nm_assert(r > 0); +- nm_assert(r < G_MAXINT); ++ nm_assert(rstr0->r.str == rstr0->str_data); ++ nm_assert(rstr0->r.str[rstr0->r.len] == '\0'); + +- nm_assert(rstr0 == g_hash_table_lookup(gl_hash, rstr0)); +- G_UNLOCK(gl_lock); +-#endif ++ if (NM_MORE_ASSERTS > 10) { ++ G_LOCK(gl_lock); ++ r = g_atomic_int_get(&rstr0->ref_count); ++ nm_assert(r > 0); ++ nm_assert(r < G_MAXINT); ++ ++ nm_assert(rstr0 == g_hash_table_lookup(gl_hash, rstr0)); ++ G_UNLOCK(gl_lock); ++ } + } + + /** diff --git a/debian/patches/tests-add-bin-sbin-to-PATH-for-unit-tests.patch b/debian/patches/tests-add-bin-sbin-to-PATH-for-unit-tests.patch new file mode 100644 index 00000000..5e0f1733 --- /dev/null +++ b/debian/patches/tests-add-bin-sbin-to-PATH-for-unit-tests.patch @@ -0,0 +1,43 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Mon, 15 Feb 2021 13:49:19 +0100 +Subject: tests: add "/bin:/sbin" to "$PATH" for unit tests + +We call `tc` from iproute2, which commonly is at "/sbin/tc". +That might not be in the "$PATH" of a regular user, and consequently +we fail to run the test. + +Work around that by always adding "/bin" and "/sbin" to the $PATH. + +(cherry picked from commit f591aa41c6acb9c890e57c822058b5e47b8aeca6) +--- + shared/nm-utils/nm-test-utils.h | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/shared/nm-utils/nm-test-utils.h b/shared/nm-utils/nm-test-utils.h +index 6b41c11..d51f972 100644 +--- a/shared/nm-utils/nm-test-utils.h ++++ b/shared/nm-utils/nm-test-utils.h +@@ -624,6 +624,23 @@ __nmtst_init(int * argc, + g_setenv("G_MESSAGES_DEBUG", "all", TRUE); + } + ++ /* "tc" is in /sbin, which might not be in $PATH of a regular user. Unconditionally ++ * add "/bin" and "/sbin" to $PATH for all tests. */ ++ { ++ static char *path_new; ++ const char * path_old; ++ ++ g_assert(!path_new); ++ ++ path_old = g_getenv("PATH"); ++ path_new = g_strjoin("", ++ path_old ?: "", ++ (nm_str_is_empty(path_old) ? "" : ":"), ++ "/bin:/sbin", ++ NULL); ++ g_setenv("PATH", path_new, TRUE); ++ } ++ + /* Delay messages until we setup logging. */ + for (i = 0; i < debug_messages->len; i++) + __NMTST_LOG(g_message, "%s", g_array_index(debug_messages, const char *, i)); diff --git a/debian/patches/wireguard-prefer-last-resolved-IP-from-resolving-endpoint.patch b/debian/patches/wireguard-prefer-last-resolved-IP-from-resolving-endpoint.patch new file mode 100644 index 00000000..e61dfc25 --- /dev/null +++ b/debian/patches/wireguard-prefer-last-resolved-IP-from-resolving-endpoint.patch @@ -0,0 +1,110 @@ +From: Thomas Haller <thaller@redhat.com> +Date: Sat, 13 Feb 2021 15:47:31 +0100 +Subject: wireguard: prefer last resolved IP from resolving endpoint from DNS + +We periodically re-resolve the DNS name for entpoints. Since WireGuard +has no concept of being connected, we want to eventually pick up +if the DNS name resolves to a different IP address. + +However, on resolution failure, we will never clear the endpoint we +already have. Thus, resolving names can only give a better endpoint, +not remove an IP address entirely. + +DNS names might do Round-Robin load distribution and the name of the +endpoint might resolve to multiple IP addresses. Improve to stick to +the IP address that we already have -- provided that the IP address +is still among the new resolution result. Otherwise, we continue to +pick the first IP address that was resolved. + +(cherry picked from commit 98348ee5396dde5756fbb82ebf16b90790b6b32d) +--- + src/core/devices/nm-device-wireguard.c | 42 +++++++++++++++++++++------------- + 1 file changed, 26 insertions(+), 16 deletions(-) + +diff --git a/src/core/devices/nm-device-wireguard.c b/src/core/devices/nm-device-wireguard.c +index fd057de..5bee09e 100644 +--- a/src/core/devices/nm-device-wireguard.c ++++ b/src/core/devices/nm-device-wireguard.c +@@ -729,7 +729,7 @@ _peers_resolve_cb(GObject *source_object, GAsyncResult *res, gpointer user_data) + PeerData * peer_data; + gs_free_error GError *resolv_error = NULL; + GList * list; +- gboolean changed = FALSE; ++ gboolean changed; + NMSockAddrUnion sockaddr; + gint64 retry_in_msec; + char s_sockaddr[100]; +@@ -775,36 +775,49 @@ _peers_resolve_cb(GObject *source_object, GAsyncResult *res, gpointer user_data) + } + + sockaddr = (NMSockAddrUnion) NM_SOCK_ADDR_UNION_INIT_UNSPEC; ++ changed = FALSE; + + if (!resolv_error) { + GList *iter; + + for (iter = list; iter; iter = iter->next) { +- GInetAddress *a = iter->data; +- GSocketFamily f = g_inet_address_get_family(a); ++ GInetAddress * a = iter->data; ++ NMSockAddrUnion sockaddr_tmp; ++ NMSockAddrUnion *s; + +- if (f == G_SOCKET_FAMILY_IPV4) { ++ s = sockaddr.sa.sa_family == AF_UNSPEC ? &sockaddr : &sockaddr_tmp; ++ ++ switch (g_inet_address_get_family(a)) { ++ case G_SOCKET_FAMILY_IPV4: + nm_assert(g_inet_address_get_native_size(a) == sizeof(struct in_addr)); +- sockaddr.in = (struct sockaddr_in){ ++ s->in = (struct sockaddr_in){ + .sin_family = AF_INET, + .sin_port = htons(nm_sock_addr_endpoint_get_port( + _nm_wireguard_peer_get_endpoint(peer_data->peer))), + }; +- memcpy(&sockaddr.in.sin_addr, g_inet_address_to_bytes(a), sizeof(struct in_addr)); ++ memcpy(&s->in.sin_addr, g_inet_address_to_bytes(a), sizeof(struct in_addr)); + break; +- } +- if (f == G_SOCKET_FAMILY_IPV6) { ++ case G_SOCKET_FAMILY_IPV6: + nm_assert(g_inet_address_get_native_size(a) == sizeof(struct in6_addr)); +- sockaddr.in6 = (struct sockaddr_in6){ ++ s->in6 = (struct sockaddr_in6){ + .sin6_family = AF_INET6, + .sin6_port = htons(nm_sock_addr_endpoint_get_port( + _nm_wireguard_peer_get_endpoint(peer_data->peer))), + .sin6_scope_id = 0, + .sin6_flowinfo = 0, + }; +- memcpy(&sockaddr.in6.sin6_addr, +- g_inet_address_to_bytes(a), +- sizeof(struct in6_addr)); ++ memcpy(&s->in6.sin6_addr, g_inet_address_to_bytes(a), sizeof(struct in6_addr)); ++ break; ++ default: ++ continue; ++ } ++ ++ changed = TRUE; ++ if (peer_data->ep_resolv.sockaddr.sa.sa_family == AF_UNSPEC) ++ break; ++ ++ if (nm_sock_addr_union_cmp(&peer_data->ep_resolv.sockaddr, &sockaddr) == 0) { ++ changed = FALSE; + break; + } + } +@@ -819,11 +832,8 @@ _peers_resolve_cb(GObject *source_object, GAsyncResult *res, gpointer user_data) + * a possibly good IP address, since WireGuard supports automatic roaming + * anyway. Either the IP address is still good (and we would wrongly + * reject it), or it isn't -- in which case it does not hurt much. */ +- } else { +- if (nm_sock_addr_union_cmp(&peer_data->ep_resolv.sockaddr, &sockaddr) != 0) +- changed = TRUE; ++ } else if (changed) + peer_data->ep_resolv.sockaddr = sockaddr; +- } + + if (resolv_error || peer_data->ep_resolv.sockaddr.sa.sa_family == AF_UNSPEC) { + /* while it technically did not fail, something is probably odd. Retry frequently to diff --git a/debian/rules b/debian/rules index 784ce12d..55e2e500 100755 --- a/debian/rules +++ b/debian/rules @@ -28,6 +28,7 @@ override_dh_auto_configure: --with-iptables=/usr/sbin/iptables \ --with-dnsmasq=/usr/sbin/dnsmasq \ --with-dnssec-trigger=/usr/lib/dnssec-trigger/dnssec-trigger-script \ + --with-polkit-agent-helper-1=/usr/lib/policykit-1/polkit-agent-helper-1 \ --with-systemdsystemunitdir=/lib/systemd/system \ --with-udev-dir=/lib/udev \ --with-dbus-sys-dir=/usr/share/dbus-1/system.d \ |