summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* proxy: use CList to track configs in NMPacrunnnerManagerth/c-listThomas Haller2017-05-111-73/+95
| | | | | | | | | | | | | | | | | - config->removed can be replaced by c_list_is_empty(&config->lst) - downgrade some assertions to nm_assert(). Even without the assert we crash a few lines later with a NULL pointer access. That gives almost the same debuggability and discoverability of the bug. - use exected type signature for GAsyncReadyCallback and avoid the cast. - when the name owner disappears, cancel all asynchronous operations. Note how the new pacrunner instance will anyway start without configuration, so for all purpose, all pending operations are at that moment obsolete.
* agent-manager: use CList to track requestsThomas Haller2017-05-111-57/+37
|
* agent-manager/trivial: move codeThomas Haller2017-05-111-46/+48
|
* secret-agent: use CList to track requestsThomas Haller2017-05-111-21/+20
|
* firewall: use CList to track pending_callsThomas Haller2017-05-111-19/+20
|
* libnm: fix type for "notify_id" source id in "nm-object.c"Thomas Haller2017-05-111-1/+1
|
* libnm: remove unused code reload_results and reload_error from "nm-object.c"Thomas Haller2017-05-111-24/+0
| | | | Fixes: 1f5b48a59eb46c40cb10bf4381b2b21a19a9f471
* libnm: use CList instead of GSList for pending in "nm-object.c"Thomas Haller2017-05-111-13/+18
|
* libnm: use CList instead of GSList for notify_items in "nm-object.c"Thomas Haller2017-05-111-16/+26
|
* libnm: use CList instead of GSList for pending_activations in "nm-manager.c"Thomas Haller2017-05-111-14/+16
|
* ifcfg-rh: refactor shvar.c to use CList instead of GListThomas Haller2017-05-111-77/+61
|
* shared: add "nm-utils/c-list.h" headerThomas Haller2017-05-112-0/+441
| | | | | | | Include the circular, doubly-linked list implementation from c-util/c-list [1], commit b1b07b42da1ede3de02e5c419376b92033652eab. [1] https://github.com/c-util/c-list
* proxy: fix passing cancellable to async D-Bus operationsThomas Haller2017-05-111-1/+0
| | | | | | | | | | | | We must not cancel pacrunner_cancellable when the D-Bus proxy is created. Instead, keep it around and use it later for the asynchronous D-Bus operations. This doesn't really matter at the moment, because the pacrunner manager is only destroyed when NetworkManager is about to terminated. That is the only time when we actually cancel the asynchronous request. Also, at that time we no longer iterate the mainloop, so the pending requests are never completed anyway.
* proxy: fix refcount handing for DestroyProxyConfiguration operationThomas Haller2017-05-111-0/+1
| | | | Fixes: e895beb0da38fc87ce93fe7403a6b50e92f0dd82
* systemd: merge branch systemd into masterThomas Haller2017-05-108-5/+122
|\
| * systemd: update code from upstream (2017-05-10)Thomas Haller2017-05-108-5/+120
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a direct dump from systemd git on 2017-05-10, git commit 61b2f1976cec698696f6a2fe9b2f2c89e72571de. ====== SYSTEMD_DIR=../systemd COMMIT=61b2f1976cec698696f6a2fe9b2f2c89e72571de ( cd "$SYSTEMD_DIR" git checkout "$COMMIT" git reset --hard git clean -fdx ) git ls-files :/src/systemd/src/ | xargs -d '\n' rm -f nm_copy_sd() { mkdir -p "./src/systemd/$(dirname "$1")" cp "$SYSTEMD_DIR/$1" "./src/systemd/$1" } nm_copy_sd "src/basic/alloc-util.c" nm_copy_sd "src/basic/alloc-util.h" nm_copy_sd "src/basic/async.h" nm_copy_sd "src/basic/escape.c" nm_copy_sd "src/basic/escape.h" nm_copy_sd "src/basic/ether-addr-util.c" nm_copy_sd "src/basic/ether-addr-util.h" nm_copy_sd "src/basic/extract-word.c" nm_copy_sd "src/basic/extract-word.h" nm_copy_sd "src/basic/fileio.c" nm_copy_sd "src/basic/fileio.h" nm_copy_sd "src/basic/fd-util.c" nm_copy_sd "src/basic/fd-util.h" nm_copy_sd "src/basic/fs-util.c" nm_copy_sd "src/basic/fs-util.h" nm_copy_sd "src/basic/hash-funcs.c" nm_copy_sd "src/basic/hash-funcs.h" nm_copy_sd "src/basic/hashmap.c" nm_copy_sd "src/basic/hashmap.h" nm_copy_sd "src/basic/hexdecoct.c" nm_copy_sd "src/basic/hexdecoct.h" nm_copy_sd "src/basic/hostname-util.c" nm_copy_sd "src/basic/hostname-util.h" nm_copy_sd "src/basic/in-addr-util.c" nm_copy_sd "src/basic/in-addr-util.h" nm_copy_sd "src/basic/io-util.c" nm_copy_sd "src/basic/io-util.h" nm_copy_sd "src/basic/list.h" nm_copy_sd "src/basic/log.h" nm_copy_sd "src/basic/macro.h" nm_copy_sd "src/basic/mempool.h" nm_copy_sd "src/basic/mempool.c" nm_copy_sd "src/basic/parse-util.c" nm_copy_sd "src/basic/parse-util.h" nm_copy_sd "src/basic/path-util.c" nm_copy_sd "src/basic/path-util.h" nm_copy_sd "src/basic/prioq.h" nm_copy_sd "src/basic/prioq.c" nm_copy_sd "src/basic/random-util.c" nm_copy_sd "src/basic/random-util.h" nm_copy_sd "src/basic/refcnt.h" nm_copy_sd "src/basic/set.h" nm_copy_sd "src/basic/signal-util.h" nm_copy_sd "src/basic/siphash24.c" nm_copy_sd "src/basic/siphash24.h" nm_copy_sd "src/basic/socket-util.c" nm_copy_sd "src/basic/socket-util.h" nm_copy_sd "src/basic/sparse-endian.h" nm_copy_sd "src/basic/stdio-util.h" nm_copy_sd "src/basic/string-table.c" nm_copy_sd "src/basic/string-table.h" nm_copy_sd "src/basic/string-util.c" nm_copy_sd "src/basic/string-util.h" nm_copy_sd "src/basic/strv.c" nm_copy_sd "src/basic/strv.h" nm_copy_sd "src/basic/time-util.c" nm_copy_sd "src/basic/time-util.h" nm_copy_sd "src/basic/umask-util.h" nm_copy_sd "src/basic/unaligned.h" nm_copy_sd "src/basic/utf8.c" nm_copy_sd "src/basic/utf8.h" nm_copy_sd "src/basic/util.c" nm_copy_sd "src/basic/util.h" nm_copy_sd "src/libsystemd-network/arp-util.c" nm_copy_sd "src/libsystemd-network/arp-util.h" nm_copy_sd "src/libsystemd-network/dhcp6-internal.h" nm_copy_sd "src/libsystemd-network/dhcp6-lease-internal.h" nm_copy_sd "src/libsystemd-network/dhcp6-network.c" nm_copy_sd "src/libsystemd-network/dhcp6-option.c" nm_copy_sd "src/libsystemd-network/dhcp6-protocol.h" nm_copy_sd "src/libsystemd-network/dhcp-identifier.c" nm_copy_sd "src/libsystemd-network/dhcp-identifier.h" nm_copy_sd "src/libsystemd-network/dhcp-internal.h" nm_copy_sd "src/libsystemd-network/dhcp-lease-internal.h" nm_copy_sd "src/libsystemd-network/dhcp-network.c" nm_copy_sd "src/libsystemd-network/dhcp-option.c" nm_copy_sd "src/libsystemd-network/dhcp-packet.c" nm_copy_sd "src/libsystemd-network/dhcp-protocol.h" nm_copy_sd "src/libsystemd-network/lldp-internal.h" nm_copy_sd "src/libsystemd-network/lldp-neighbor.c" nm_copy_sd "src/libsystemd-network/lldp-neighbor.h" nm_copy_sd "src/libsystemd-network/lldp-network.c" nm_copy_sd "src/libsystemd-network/lldp-network.h" nm_copy_sd "src/libsystemd-network/network-internal.c" nm_copy_sd "src/libsystemd-network/network-internal.h" nm_copy_sd "src/libsystemd-network/sd-dhcp6-client.c" nm_copy_sd "src/libsystemd-network/sd-dhcp6-lease.c" nm_copy_sd "src/libsystemd-network/sd-dhcp-client.c" nm_copy_sd "src/libsystemd-network/sd-dhcp-lease.c" nm_copy_sd "src/libsystemd-network/sd-ipv4ll.c" nm_copy_sd "src/libsystemd-network/sd-ipv4acd.c" nm_copy_sd "src/libsystemd-network/sd-lldp.c" nm_copy_sd "src/libsystemd/sd-event/sd-event.c" nm_copy_sd "src/libsystemd/sd-id128/id128-util.c" nm_copy_sd "src/libsystemd/sd-id128/id128-util.h" nm_copy_sd "src/libsystemd/sd-id128/sd-id128.c" nm_copy_sd "src/shared/dns-domain.c" nm_copy_sd "src/shared/dns-domain.h" nm_copy_sd "src/systemd/_sd-common.h" nm_copy_sd "src/systemd/sd-dhcp6-client.h" nm_copy_sd "src/systemd/sd-dhcp6-lease.h" nm_copy_sd "src/systemd/sd-dhcp-client.h" nm_copy_sd "src/systemd/sd-dhcp-lease.h" nm_copy_sd "src/systemd/sd-event.h" nm_copy_sd "src/systemd/sd-ndisc.h" nm_copy_sd "src/systemd/sd-id128.h" nm_copy_sd "src/systemd/sd-ipv4acd.h" nm_copy_sd "src/systemd/sd-ipv4ll.h" nm_copy_sd "src/systemd/sd-lldp.h"
* | contrib/rpm: fix specifying build with/without libpslThomas Haller2017-05-101-2/+2
| | | | | | | | Fixes: faad17f9e8e804e89ffd5a779ed22871a77755e0
* | contrib/rpm: reorder variables in spec fileThomas Haller2017-05-101-4/+3
| |
* | utils: fix maybe-uninitialized in "nm-udev-utils.c"Thomas Haller2017-05-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CC shared/nm-utils/libnm_core_libnm_core_la-nm-udev-utils.lo In file included from ./shared/nm-utils/nm-glib.h:27:0, from ./shared/nm-utils/nm-macros-internal.h:29, from ./shared/nm-default.h:178, from shared/nm-utils/nm-udev-utils.c:21: shared/nm-utils/nm-udev-utils.c: In function ‘nm_udev_client_enumerate_new’: ./shared/nm-utils/gsystem-local-alloc.h:53:50: error: ‘to_free’ may be used uninitialized in this function [-Werror=maybe-uninitialized] GS_DEFINE_CLEANUP_FUNCTION(void*, gs_local_free, g_free) ^~~~~~ shared/nm-utils/nm-udev-utils.c:147:18: note: ‘to_free’ was declared here gs_free char *to_free; ^~~~~~~ In file included from ./shared/nm-utils/nm-glib.h:27:0, from ./shared/nm-utils/nm-macros-internal.h:29, from ./shared/nm-default.h:178, from shared/nm-utils/nm-udev-utils.c:21: shared/nm-utils/nm-udev-utils.c: In function ‘nm_udev_client_new’: ./shared/nm-utils/gsystem-local-alloc.h:53:50: error: ‘to_free’ may be used uninitialized in this function [-Werror=maybe-uninitialized] GS_DEFINE_CLEANUP_FUNCTION(void*, gs_local_free, g_free) ^~~~~~ shared/nm-utils/nm-udev-utils.c:243:20: note: ‘to_free’ was declared here gs_free char *to_free; ^~~~~~~ Fixes: e32839838e5ea74ba490cf912e20939afa0e4f40
* | release: bump version to 1.9.1-dev after 1.8.0 release1.9.1-devThomas Haller2017-05-10149-178979/+296625
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | After 1.8.0 is released, merge it back into master so that 1.8.0 is part of the history of master. That means, $ git log --first-parent master will also traverse 1.8.0 and 1.8-rc*. Also bump the micro version to 1.9.1-dev to indicate that this is after 1.8.0 is out.
| * | po: make update-poThomas Haller2017-05-1066-44695/+46535
| | |
| * | firewall: avoid invalid -Werror=maybe-uninitialized warning in ↵Thomas Haller2017-05-101-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | _handle_dbus_start() ../../src/nm-firewall-manager.c: In function ‘_handle_dbus_start’: ../../src/nm-firewall-manager.c:318:2: error: ‘dbus_method’ may be used uninitialized in this function [-Werror=maybe-uninitialized] g_dbus_proxy_call (priv->proxy, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ dbus_method, ~~~~~~~~~~~~ arg, ~~~~ Fixes: d8bf05d3e695f043eeb0fac4646fc6babad1bee3
| * | connectivity: don't do periodic checks on interval=0Lubomir Rintel2017-05-101-1/+2
| | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=1449296 Fixes: 7307dea9c4da6cdc53e4c23c4ce07cf51bd0c4b7
| * | device: don't await for IPv6 DAD to finish if we are ignoring that there's ↵Lubomir Rintel2017-05-101-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | no carrier It's not the correct thing to do, but is the same behavior we've done previously. DAD is not even going to start until there's carrier and the client would just wait indefinitely. Ideally, the client would choose not to waiat, but it currently there's no way the client would discover what is going on. https://bugzilla.redhat.com/show_bug.cgi?id=1446367
| * | travis: fix build due to missing libcurl libraryThomas Haller2017-05-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Since using libcurl for connectivity checks, we failed to build with connectivity checking on travis. Fix that by installing the required library (from trusty). Fixes: 4e6967e33d912511f38b347c061cecb2ac4421fc
| * | build: set --enable-conckeck as defaultFrancesco Giudici2017-05-101-3/+3
| | | | | | | | | | | | | | | | | | connectivity check functionality should be explicitly set as disabled if not wanted: this prevents building NM without connectivity check support without any evident warning on systems where libcurl is not installed.
| * | manager: avoid generating in memory connections during startup for managed ↵Francesco Giudici2017-05-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | devices Commit #acf1067a allowed to assume connections on already managed devices. Anyway, in complex scenario with layered connections, during the startup of NetworkManager, this could interfere with the connection assumption based on saved state. So, avoid to re-assume connections on already managed devices during startup. Fixes: acf1067a455b02b60985e209df568d3fcc3fac9e
| * | dhcp: set @was_active flag for external activationsBeniamino Galvani2017-05-081-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Set the @was_active flag for external activations with DHCP, so that DHCP is retried multiple times in case of failure, as we do for managed connections when the lease expires and for assumed connections. Fixes test: renewal_gw_after_dhcp_outage_for_assumed_var1 Fixes: e3113fdc4b01d79080911b7450fc032dc0a85108
| * | platform: fix double initializationBeniamino Galvani2017-05-081-1/+1
| | |
| * | device: fix check in addrconf6_start()Beniamino Galvani2017-05-081-10/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | We check the return value of _get_stable_id(); when it is NULL priv->ndisc would stay NULL too and we would crash when dereferencing @error. Actually, _get_stable_id() can never return NULL, so replace the check with an assertion.
| * | ip-tunnel: fix coverity warningsBeniamino Galvani2017-05-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | src/devices/nm-device-ip-tunnel.c:257:8: warning: Branch condition evaluates to a garbage value if (local4) ^~~~~~ src/devices/nm-device-ip-tunnel.c:264:8: warning: Branch condition evaluates to a garbage value if (remote4) ^~~~~~~
| * | clients: print expected route syntax on parsing failureBeniamino Galvani2017-05-081-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that routes can include optional attributes, print the expected syntax in case of parsing failure. $ nmcli connection modify dummy ipv4.routes a Error: failed to modify ipv4.routes: invalid route: Invalid IPv4 address 'a'. The valid syntax is: 'ip[/prefix] [next-hop] [metric] [attribute=val]... [,ip[/prefix] ...]'.
| * | device: synchronize IPv6 configuration in stage3 (take 2)Beniamino Galvani2017-05-061-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most of the IPv6 methods require a non-tentative link local address configured on the interface; we look at priv->ip6_config to determine if such address exist. If the configuration is out-of-sync, we may proceed with configuration when the link-local address does not exist or is still tentative, especially because we toggle the "disable_ipv6" sysctl parameter just before, which clears all IPv6 addresses on the interface. Ensure that priv->ext_ip6_config_captured is up-to-date before continuing with the IPv6 configuration, and use it to determine whether suitable addresses are present. Fixes test: @ipv6_set_ra_announced_mtu Fixes: 8f4caab60196132c2fd0eb4a444f93f78f130e8e
| * | Revert "device: synchronize IPv6 configuration in stage3"Beniamino Galvani2017-05-061-13/+4
| | | | | | | | | | | | | | | | | | | | | | | | update_ip6_config() also removes addresses and routes no longer present externally from the configuration, so it can't be called before the changes are committed. This reverts commit 8f4caab60196132c2fd0eb4a444f93f78f130e8e.
| * | all: merge branch 'th/user-data-v2-bgo776276'Thomas Haller2017-05-0617-79/+1136
| |\ \ | | | | | | | | | | | | | | | | https://bugzilla.gnome.org/show_bug.cgi?id=776276 https://bugzilla.redhat.com/show_bug.cgi?id=1421429
| | * | examples: add setting-user-data.pyThomas Haller2017-05-062-6/+253
| | | | | | | | | | | | | | | | | | | | | | | | Add an example python script to show and set setting's user-data. This is useful, as nmcli still doesn't support user data.
| | * | ifcfg: add read/write support for user-dataThomas Haller2017-05-069-5/+356
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The user data values are encoded in shell variables named prefix "NM_USER_". The variable name is an encoded form of the data key, consisting only of upper-case letters, digits, and underscore. The alternative would be something like NM_USER_1_KEY=my.keys.1 NM_USER_1_VAL='some value' NM_USER_2_KEY=my.other.KEY.42 NM_USER_2_VAL='other value' contary to NM_USER_MY__KEYS__1='some value' NM_USER_MY__OTHER___K_E_Y__42='other value' The advantage of the former, numbered scheme is that it may be easier to find the key of a user-data entry. With the current implementation, the shell script would have to decode the key, like the ifcfg-rh plugin does. However, user data keys are opaque identifers for values. Usually, you are not concerned with a certain name of the key, you already know it. Hence, you don't need to write a shell script to decode the key name, instead, you can use it directly: if [ -z ${NM_USER_MY__OTHER___K_E_Y__42+x} ]; then do_something_with_key "$NM_USER_MY__OTHER___K_E_Y__42" fi Otherwise, you'd first have to search write a shell script to search for the interesting key -- in this example "$NM_USER_2_KEY", before being able to access the value "$NM_USER_2_VAL".
| | * | libnm/keyfile: properly read user data from keyfileThomas Haller2017-05-062-19/+116
| | | | | | | | | | | | | | | | | | | | Hack keyfile reader support for NMSettingUser. Writer support already works.
| | * | libnm: track invalid user data separately and reject during verify()Thomas Haller2017-05-061-49/+131
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nm_setting_user_set_data() rejects invalid keys and values, and can fail. This API is correct never to fail, like the get_data() only returns valid user-data. However, the g_object_set() API allows to set the hash directly but it cannot report errors for invalid values. This API is used to initialize the value from D-Bus or keyfile, hence it is wrong to emit g_critial() assertions for untrusted data. It would also be wrong to silently drop all invalid date, because then the user cannot get an error message to understand what happend. The correct but cumbersome solution is to remember the invalid values separately, so that verify() can report the setting as invalid.
| | * | keyfile: fix handling unsupported characters in keysThomas Haller2017-05-065-5/+286
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | vpn.data, bond.options, and user.data encode their values directly as keys in keyfile. However, keys for GKeyFile may not contain characters like '='. We need to escape such special characters, otherwise an assertion is hit on the server: $ nmcli connection modify "$VPN_NAME" +vpn.data 'aa[=value' Another example of encountering the assertion is when setting user-data key with an invalid character "my.this=key=is=causes=a=crash".
| | * | keyfile: minor refactoring dropping temporary variable in mac_address_parser()Thomas Haller2017-05-061-2/+1
| | | |
| | * | keyfile: fix memleak in read_hash_of_string()Thomas Haller2017-05-061-3/+3
| |/ / | | | | | | | | | Fixes: 10661abe174862c71603cb385e20fee5a6671997
| * | all: fix typo 'entires' -> 'entries'Beniamino Galvani2017-05-0510-18/+18
| | |
| * | build: fix docs buildingFrancesco Giudici2017-05-051-18/+18
| | | | | | | | | | | | Fixes: 378cbca6f7cedec3ed8ac978feccec267f0f7069
| * | device: synchronize IPv6 configuration in stage3Beniamino Galvani2017-05-051-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most of the IPv6 methods require a non-tentative link local address configured on the interface; we look at priv->ip6_config to determine if such address exist. If the configuration is out-of-sync, we may proceed with configuration when the link-local address does not exist or is still tentative, especially because we toggle the "disable_ipv6" sysctl parameter just before, which clears all IPv6 addresses on the interface. Ensure that priv->ip6_config is up-to-date before continuing with the IPv6 configuration. Fixes test: @ipv6_set_ra_announced_mtu
| * | build: restore --enable-concheck as default if libcurl is detectedFrancesco Giudici2017-05-051-3/+6
| | | | | | | | | | | | | | | | | | Recently we removed libsoup dependency in favor of libcurl. Connectivity checking functionality was enabled by defaut when libsoup was detected: do the same now when detecting libcurl.
| * | build/trivial: normalize configure.ac formatting/spacingFrancesco Giudici2017-05-051-343/+413
| | |
| * | connectivity: fix typo in error messageFrancesco Giudici2017-05-051-1/+1
| | |
| * | device/firewall: merge branch 'th/firewall-apply-early-rh1445242'Thomas Haller2017-05-051-101/+86
| |\ \ | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=1445242
| | * | device: track firewall state and reset zone during activationThomas Haller2017-05-051-100/+85
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nm_device_update_firewall_zone() would only reconfigure the firewall zone when the device is fully activated. That means, while the device is activating, changing the firewall zone is not working. Activation might take a long time with DHCP, or with master devices waiting for their slaves. For example: nmcli connection add type team con-name t-team ifname i-team autoconnect no nmcli connection up t-team Note how t-team/i-team is waiting for a slave device. During stage3, we already set firewall.zone to default. nmcli connection modify t-team connection.zone external Note how changing the firewall zone does not immidiately take effect. Only later, during IP_CHECK state the firewall zone is reset -- but only for devices with differing ip_ifindex. https://bugzilla.redhat.com/show_bug.cgi?id=1445242