From aafc1dbe4712c86189bbc1d4d54ad8cb4c69be7e Mon Sep 17 00:00:00 2001
From: Michael Biebl
cmp_flags
tune how to compare attributes. Currently only +
tune how to compare attributes. Currently, only NM_IP_ROUTE_EQUAL_CMP_FLAGS_NONE (0) and NM_IP_ROUTE_EQUAL_CMP_FLAGS_WITH_ATTRS (1) is supported.
extra_args
extra arguments for controlling the string -conversion. Currently not extra arguments are supported.
extra_args
extra arguments for controlling the string -conversion. Currently not extra arguments are supported.
-nm_setting_ip_config_next_valid_dns_option ()
-int
-nm_setting_ip_config_next_valid_dns_option
- (NMSettingIPConfig *setting,
- guint idx);
-
-
-Returns
- the index, greater or equal than idx
-, of the first valid
-DNS option, or -1 if no valid option is found
-
-Since: 1.2
-
-
-
nm_setting_ip_config_add_dns_option ()
gboolean
nm_setting_ip_config_add_dns_option (NMSettingIPConfig *setting,
@@ -5898,12 +5893,138 @@ property.
Since: 1.22
+
+
+nm_setting_ip_config_get_dhcp_reject_servers ()
+const char *const *
+nm_setting_ip_config_get_dhcp_reject_servers
+ (NMSettingIPConfig *setting,
+ guint *out_len);
+
+Parameters
+
+
+
+
+
+
+
+
+setting
+
+
+
+
+out_len
+the number of returned elements.
+[allow-none][out]
+
+
+
+
+
+Returns
+A NULL terminated array of DHCP reject servers. Even if no reject
+servers are configured, this always returns a non NULL value.
+[array length=out_len zero-terminated=1][transfer none]
+
+Since: 1.28
+
+
+
+nm_setting_ip_config_add_dhcp_reject_server ()
+void
+nm_setting_ip_config_add_dhcp_reject_server
+ (NMSettingIPConfig *setting,
+ const char *server);
+Adds a new DHCP reject server to the setting.
+
+Since: 1.28
+
+
+
+nm_setting_ip_config_remove_dhcp_reject_server ()
+void
+nm_setting_ip_config_remove_dhcp_reject_server
+ (NMSettingIPConfig *setting,
+ guint idx);
+Removes the DHCP reject server at index idx
+.
+
+Since: 1.28
+
+
+
+nm_setting_ip_config_clear_dhcp_reject_servers ()
+void
+nm_setting_ip_config_clear_dhcp_reject_servers
+ (NMSettingIPConfig *setting);
+Removes all configured DHCP reject servers.
+
+Since: 1.28
+
Types and Values
NM_IP_ADDRESS_ATTRIBUTE_LABEL
-#define NM_IP_ADDRESS_ATTRIBUTE_LABEL "label"
+#define NM_IP_ADDRESS_ATTRIBUTE_LABEL "label"
@@ -5945,103 +6066,103 @@ the return value merely indicates equality (zero) or inequality.
NM_IP_ROUTE_ATTRIBUTE_CWND
-#define NM_IP_ROUTE_ATTRIBUTE_CWND "cwnd"
+#define NM_IP_ROUTE_ATTRIBUTE_CWND "cwnd"
NM_IP_ROUTE_ATTRIBUTE_FROM
-#define NM_IP_ROUTE_ATTRIBUTE_FROM "from"
+#define NM_IP_ROUTE_ATTRIBUTE_FROM "from"
NM_IP_ROUTE_ATTRIBUTE_INITCWND
-#define NM_IP_ROUTE_ATTRIBUTE_INITCWND "initcwnd"
+#define NM_IP_ROUTE_ATTRIBUTE_INITCWND "initcwnd"
NM_IP_ROUTE_ATTRIBUTE_INITRWND
-#define NM_IP_ROUTE_ATTRIBUTE_INITRWND "initrwnd"
+#define NM_IP_ROUTE_ATTRIBUTE_INITRWND "initrwnd"
NM_IP_ROUTE_ATTRIBUTE_LOCK_CWND
-#define NM_IP_ROUTE_ATTRIBUTE_LOCK_CWND "lock-cwnd"
+#define NM_IP_ROUTE_ATTRIBUTE_LOCK_CWND "lock-cwnd"
NM_IP_ROUTE_ATTRIBUTE_LOCK_INITCWND
-#define NM_IP_ROUTE_ATTRIBUTE_LOCK_INITCWND "lock-initcwnd"
+#define NM_IP_ROUTE_ATTRIBUTE_LOCK_INITCWND "lock-initcwnd"
NM_IP_ROUTE_ATTRIBUTE_LOCK_INITRWND
-#define NM_IP_ROUTE_ATTRIBUTE_LOCK_INITRWND "lock-initrwnd"
+#define NM_IP_ROUTE_ATTRIBUTE_LOCK_INITRWND "lock-initrwnd"
NM_IP_ROUTE_ATTRIBUTE_LOCK_MTU
-#define NM_IP_ROUTE_ATTRIBUTE_LOCK_MTU "lock-mtu"
+#define NM_IP_ROUTE_ATTRIBUTE_LOCK_MTU "lock-mtu"
NM_IP_ROUTE_ATTRIBUTE_LOCK_WINDOW
-#define NM_IP_ROUTE_ATTRIBUTE_LOCK_WINDOW "lock-window"
+#define NM_IP_ROUTE_ATTRIBUTE_LOCK_WINDOW "lock-window"
NM_IP_ROUTE_ATTRIBUTE_MTU
-#define NM_IP_ROUTE_ATTRIBUTE_MTU "mtu"
+#define NM_IP_ROUTE_ATTRIBUTE_MTU "mtu"
NM_IP_ROUTE_ATTRIBUTE_ONLINK
-#define NM_IP_ROUTE_ATTRIBUTE_ONLINK "onlink"
+#define NM_IP_ROUTE_ATTRIBUTE_ONLINK "onlink"
NM_IP_ROUTE_ATTRIBUTE_SCOPE
-#define NM_IP_ROUTE_ATTRIBUTE_SCOPE "scope"
+#define NM_IP_ROUTE_ATTRIBUTE_SCOPE "scope"
NM_IP_ROUTE_ATTRIBUTE_SRC
-#define NM_IP_ROUTE_ATTRIBUTE_SRC "src"
+#define NM_IP_ROUTE_ATTRIBUTE_SRC "src"
NM_IP_ROUTE_ATTRIBUTE_TABLE
-#define NM_IP_ROUTE_ATTRIBUTE_TABLE "table"
+#define NM_IP_ROUTE_ATTRIBUTE_TABLE "table"
NM_IP_ROUTE_ATTRIBUTE_TOS
-#define NM_IP_ROUTE_ATTRIBUTE_TOS "tos"
+#define NM_IP_ROUTE_ATTRIBUTE_TOS "tos"
NM_IP_ROUTE_ATTRIBUTE_TYPE
-#define NM_IP_ROUTE_ATTRIBUTE_TYPE "type"
+#define NM_IP_ROUTE_ATTRIBUTE_TYPE "type"
NM_IP_ROUTE_ATTRIBUTE_WINDOW
-#define NM_IP_ROUTE_ATTRIBUTE_WINDOW "window"
+#define NM_IP_ROUTE_ATTRIBUTE_WINDOW "window"
@@ -6099,7 +6220,7 @@ rule verfies or fail.
NM_SETTING_IP_CONFIG_DAD_TIMEOUT_MAX
-#define NM_SETTING_IP_CONFIG_DAD_TIMEOUT_MAX 30000
+#define NM_SETTING_IP_CONFIG_DAD_TIMEOUT_MAX 30000
@@ -6224,110 +6345,116 @@ rule verfies or fail.
+NM_SETTING_IP_CONFIG_DHCP_REJECT_SERVERS
+#define NM_SETTING_IP_CONFIG_DHCP_REJECT_SERVERS "dhcp-reject-servers"
+
+
+
+
NM_SETTING_IP_CONFIG_ROUTING_RULES
-#define NM_SETTING_IP_CONFIG_ROUTING_RULES "routing-rules"
+#define NM_SETTING_IP_CONFIG_ROUTING_RULES "routing-rules"
NM_SETTING_DNS_OPTION_DEBUG
-#define NM_SETTING_DNS_OPTION_DEBUG "debug"
+#define NM_SETTING_DNS_OPTION_DEBUG "debug"
NM_SETTING_DNS_OPTION_NDOTS
-#define NM_SETTING_DNS_OPTION_NDOTS "ndots"
+#define NM_SETTING_DNS_OPTION_NDOTS "ndots"
NM_SETTING_DNS_OPTION_TIMEOUT
-#define NM_SETTING_DNS_OPTION_TIMEOUT "timeout"
+#define NM_SETTING_DNS_OPTION_TIMEOUT "timeout"
NM_SETTING_DNS_OPTION_ATTEMPTS
-#define NM_SETTING_DNS_OPTION_ATTEMPTS "attempts"
+#define NM_SETTING_DNS_OPTION_ATTEMPTS "attempts"
NM_SETTING_DNS_OPTION_ROTATE
-#define NM_SETTING_DNS_OPTION_ROTATE "rotate"
+#define NM_SETTING_DNS_OPTION_ROTATE "rotate"
NM_SETTING_DNS_OPTION_NO_CHECK_NAMES
-#define NM_SETTING_DNS_OPTION_NO_CHECK_NAMES "no-check-names"
+#define NM_SETTING_DNS_OPTION_NO_CHECK_NAMES "no-check-names"
NM_SETTING_DNS_OPTION_INET6
-#define NM_SETTING_DNS_OPTION_INET6 "inet6"
+#define NM_SETTING_DNS_OPTION_INET6 "inet6"
NM_SETTING_DNS_OPTION_IP6_BYTESTRING
-#define NM_SETTING_DNS_OPTION_IP6_BYTESTRING "ip6-bytestring"
+#define NM_SETTING_DNS_OPTION_IP6_BYTESTRING "ip6-bytestring"
NM_SETTING_DNS_OPTION_IP6_DOTINT
-#define NM_SETTING_DNS_OPTION_IP6_DOTINT "ip6-dotint"
+#define NM_SETTING_DNS_OPTION_IP6_DOTINT "ip6-dotint"
NM_SETTING_DNS_OPTION_NO_IP6_DOTINT
-#define NM_SETTING_DNS_OPTION_NO_IP6_DOTINT "no-ip6-dotint"
+#define NM_SETTING_DNS_OPTION_NO_IP6_DOTINT "no-ip6-dotint"
NM_SETTING_DNS_OPTION_EDNS0
-#define NM_SETTING_DNS_OPTION_EDNS0 "edns0"
+#define NM_SETTING_DNS_OPTION_EDNS0 "edns0"
NM_SETTING_DNS_OPTION_SINGLE_REQUEST
-#define NM_SETTING_DNS_OPTION_SINGLE_REQUEST "single-request"
+#define NM_SETTING_DNS_OPTION_SINGLE_REQUEST "single-request"
NM_SETTING_DNS_OPTION_SINGLE_REQUEST_REOPEN
-#define NM_SETTING_DNS_OPTION_SINGLE_REQUEST_REOPEN "single-request-reopen"
+#define NM_SETTING_DNS_OPTION_SINGLE_REQUEST_REOPEN "single-request-reopen"
NM_SETTING_DNS_OPTION_NO_TLD_QUERY
-#define NM_SETTING_DNS_OPTION_NO_TLD_QUERY "no-tld-query"
+#define NM_SETTING_DNS_OPTION_NO_TLD_QUERY "no-tld-query"
NM_SETTING_DNS_OPTION_USE_VC
-#define NM_SETTING_DNS_OPTION_USE_VC "use-vc"
+#define NM_SETTING_DNS_OPTION_USE_VC "use-vc"
NM_SETTING_DNS_OPTION_NO_RELOAD
-#define NM_SETTING_DNS_OPTION_NO_RELOAD "no-reload"
+#define NM_SETTING_DNS_OPTION_NO_RELOAD "no-reload"
NM_SETTING_DNS_OPTION_TRUST_AD
-#define NM_SETTING_DNS_OPTION_TRUST_AD "trust-ad"
+#define NM_SETTING_DNS_OPTION_TRUST_AD "trust-ad"
@@ -6449,7 +6576,7 @@ cannot be set at the same time.
The “dhcp-hostname-flags” property
“dhcp-hostname-flags” guint
Flags for the DHCP hostname and FQDN.
-Currently this property only includes flags to control the FQDN flags
+
Currently, this property only includes flags to control the FQDN flags
set in the DHCP FQDN option. Supported FQDN flags are
NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE,
NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED and
@@ -6493,6 +6620,19 @@ by dhclient, which always derives the IAID from the MAC address.
+The “dhcp-reject-servers” property
+ “dhcp-reject-servers” GStrv
+Array of servers from which DHCP offers must be rejected. This property
+is useful to avoid getting a lease from misconfigured or rogue servers.
+For DHCPv4, each element must be an IPv4 address, optionally
+followed by a slash and a prefix length (e.g. "192.168.122.0/24").
+This property is currently not implemented for DHCPv6.
+Owner: NMSettingIPConfig
+Flags: Read / Write
+Since: 1.28
+
+
+
The “dhcp-send-hostname” property
“dhcp-send-hostname” gboolean
If TRUE, a hostname is sent to the DHCP server when acquiring a lease.
@@ -6550,30 +6690,44 @@ name servers to resolv.conf, and if all contributing profiles have
“dns-priority” gint
DNS servers priority.
The relative priority for DNS servers specified by this setting. A lower
-value is better (higher priority). Zero selects a globally configured
-default value. If the latter is missing or zero too, it defaults to
-50 for VPNs (including WireGuard) and 100 for other connections.
+numerical value is better (higher priority).
+Negative values have the special effect of excluding other configurations
+with a greater numerical priority value; so in presence of at least one negative
+priority, only DNS servers from connections with the lowest priority value will be used.
+To avoid all DNS leaks, set the priority of the profile that should be used
+to the most negative value of all active connections profiles.
+Zero selects a globally configured default value. If the latter is missing
+or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for
+other connections.
Note that the priority is to order DNS settings for multiple active
connections. It does not disambiguate multiple DNS servers within the
same connection profile.
-When using dns=default, servers with higher priority will be on top of
-resolv.conf. To prioritize a given server over another one within the
-same connection, just specify them in the desired order. When multiple
-devices have configurations with the same priority, VPNs will be
+
When multiple devices have configurations with the same priority, VPNs will be
considered first, then devices with the best (lowest metric) default
-route and then all other devices. Negative values have the special
-effect of excluding other configurations with a greater priority value;
-so in presence of at least one negative priority, only DNS servers from
-connections with the lowest priority value will be used.
-When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or
-dns=systemd-resolved, each connection is used to query domains in its
-search list. Queries for domains not present in any search list are
-routed through connections having the '~.' special wildcard domain, which
-is added automatically to connections with the default route (or can be
-added manually). When multiple connections specify the same domain, the
-one with the highest priority (lowest numerical value) wins. If a
-connection specifies a domain which is subdomain of another domain with a
-negative DNS priority value, the subdomain is ignored.
+route and then all other devices.
+When using dns=default, servers with higher priority will be on top of
+resolv.conf. To prioritize a given server over another one within the
+same connection, just specify them in the desired order.
+Note that commonly the resolver tries name servers in /etc/resolv.conf
+in the order listed, proceeding with the next server in the list
+on failure. See for example the "rotate" option of the dns-options setting.
+If there are any negative DNS priorities, then only name servers from
+the devices with that lowest priority will be considered.
+When using a DNS resolver that supports Conditional Forwarding or
+Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection
+is used to query domains in its search list. The search domains determine which
+name servers to ask, and the DNS priority is used to prioritize
+name servers based on the domain. Queries for domains not present in any
+search list are routed through connections having the '~.' special wildcard
+domain, which is added automatically to connections with the default route
+(or can be added manually). When multiple connections specify the same domain, the
+one with the best priority (lowest numerical value) wins. If a sub domain
+is configured on another interface it will be accepted regardless the priority,
+unless parent domain on the other interface has a negative priority, which causes
+the sub domain to be shadowed.
+With Split DNS one can avoid undesired DNS leaks by properly configuring
+DNS priorities and the search domains, so that only name servers of the desired
+interface are configured.
Owner: NMSettingIPConfig
Flags: Read / Write
Default value: 0
@@ -6587,6 +6741,10 @@ negative DNS priority value, the subdomain is ignored.
are considered 'routing' domains and are used only to decide the
interface over which a query must be forwarded; they are not used
to complete unqualified host names.
+When using a DNS plugin that supports Conditional Forwarding or
+Split DNS, then the search domains specify which name servers to
+query. This makes the behavior different from running with plain
+/etc/resolv.conf. For more information see also the dns-priority setting.
Owner: NMSettingIPConfig
Flags: Read / Write
@@ -6610,8 +6768,8 @@ length.
The “ignore-auto-dns” property
“ignore-auto-dns” gboolean
When “method” is set to "auto" and this property to
-TRUE, automatically configured nameservers and search domains are
-ignored and only nameservers and search domains specified in the
+TRUE, automatically configured name servers and search domains are
+ignored and only name servers and search domains specified in the
“dns” and “dns-search” properties, if
any, are used.
Owner: NMSettingIPConfig
--
cgit 1.3.0-6-gf8a5