summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* WIP1th/no-polkit-agentThomas Haller2018-04-1610-133/+22
|
* cli/polkit: merge branch 'th/polkit-cleanup'Thomas Haller2018-04-169-275/+277
|\ | | | | | | https://github.com/NetworkManager/NetworkManager/pull/90
| * cli: rework callbacks in NMPolkitListener to use one vtable structureThomas Haller2018-04-164-137/+146
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of setting multiple callbacks, just let the user set one vtable with callbacks. Usually, GObject would implement this via signals. While that makes sense for public objects, for example to work better with GIR and allow intercepting the signal, this is overkill for our internal type. And NMPolkitListener already did not make use of signals, for good reason. Instead of passing multiple callbacks, must pass one structure with callback pointers. Also, extend the signature of the callbacks to always contain a @self argument and a @user_data.
| * clients: move code around in "nm-polkit-listener.c"Thomas Haller2018-04-161-77/+88
| | | | | | | | Follow a standard order for the code.
| * clients: cleanup includes for polkit sourcesThomas Haller2018-04-164-42/+21
| | | | | | | | | | | | | | | | Some cleanup of the includes. For example, immediately after "nm-default.h" include the header file for the current source. Also, move the use of the "#if WITH_POLKIT_AGENT" conditionals closer together. E.g. don't use the #if in "nmcli.h".
| * auth-subject: minor cleanup of _new_unix_process()Thomas Haller2018-04-161-3/+3
| | | | | | | | | | Drop the g_assert(), which is always compiled in, but obviously can never fail.
| * shared: move nm_utils_get_start_time_for_pid() to shared/nm-utilsThomas Haller2018-04-165-80/+83
|/ | | | | We will also use it in nmcli later. It will be needed when we replace polkit_unix_process_new_for_owner(). Which is still far down the road.
* all: merge branch 'th/settings-flags-rh1460295'Thomas Haller2018-04-1613-81/+192
|\ | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=1460295 https://github.com/NetworkManager/NetworkManager/pull/88
| * settings: add NMSettingsConnectionFlags flagsThomas Haller2018-04-162-5/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Up to now, it was not visible on D-Bus whether a connection was generated by NetworkManager and/or volatile. That is for example interesting for firewalld, which aims to store persistant configuration in NetworkManager's profile. However, that doesn't make sense for external connections (which are nm-generated & volatile). In fact, it probably makes no sense for volatile connections in general, because modifying them, likely makes them non-volatile (depending on how the profile is modified). Also, the Update2() D-Bus operation allows to carefully make connections volatile and unsaved. As we have public API to set these flags, we should also expose them on D-Bus. Related: https://bugzilla.redhat.com/show_bug.cgi?id=1460295
| * all: add D-Bus property "Flags" for Settings.Connection interfaceThomas Haller2018-04-167-2/+96
| | | | | | | | | | | | | | | | | | | | | | The D-Bus interface already has a boolean property "Unsaved". While that is nicer too look at (in the API), adding a new flag is very cumbersome, and also has more overhead. For example, it requires extending the D-Bus API, all the way down to libnm. Add a flags argument, that will allow to add future boolean flags easier.
| * settings: make NM_SETTINGS_CONNECTION_FLAGS property ↵Thomas Haller2018-04-164-26/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NM_SETTINGS_CONNECTION_FLAGS_CHANGED signal For one, these flags are "internal" flags. Soon, we will gain a new NMSettingsConnectionFlags type that is exported on D-Bus and partly overlaps with these internal flags. However, then we will need the "flags" properties to expose the public bits. This property only exists because other parts are interested in notification signals. Note that we encourage NMDbusObject types to freeze/thaw property-changed notifications. As freezing the notifications also delays the signals, this is not desired for the purpose where internal users subscribe to the signal.
| * core/trivial: rename "NMSettingsConnectionFlags" to ↵Thomas Haller2018-04-167-66/+66
|/ | | | | | | | "NMSettingsConnectionIntFlags" "NMSettingsConnectionFlags" was an internal enum. Soon, we will add such a type in libnm. Avoid the naming conflict by renaming. The "Int" stands for "internal".
* cli: merge branch 'bg/nmcli-overview-rh1434527'Beniamino Galvani2018-04-1315-173/+238
|\ | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=1434527
| * clients: use nm_utils_strv_make_deep_copied() to deep copy const strv arrayThomas Haller2018-04-131-6/+2
| |
| * nmcli: add overview option to skip default values in outputBeniamino Galvani2018-04-133-6/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new 'overview' command line option to make the output more compact and display only properties that have non-default values. Currently the option has only effect for the "connection show $CON" sub-command. $ nmcli -o connection show wifi-home connection.id: wifi-home connection.uuid: 8308c425-f2a7-4021-9afc-37bde7253c6d connection.type: 802-11-wireless connection.timestamp: 1519264421 connection.permissions: user:me 802-11-wireless.ssid: home 802-11-wireless.mode: infrastructure 802-11-wireless-security.key-mgmt: wpa-psk 802-11-wireless-security.auth-alg: open ipv4.method: auto ipv6.method: auto https://bugzilla.redhat.com/show_bug.cgi?id=1434527
| * clients: set @out_is_default in property gettersBeniamino Galvani2018-04-132-27/+117
| |
| * clients: change nm_meta_abstract_info_get() to report defaultsBeniamino Galvani2018-04-139-1/+21
| | | | | | | | | | Return a boolean to indicate whether the value is the default one, so that the caller can choose to hide it.
| * clients: meta: consolidate wep-key get functionsBeniamino Galvani2018-04-131-30/+13
| |
| * clients: meta: use enum setter for secret flagsBeniamino Galvani2018-04-131-37/+1
| |
| * clients: meta: define ipv6.ip6-privacy as an enum typeBeniamino Galvani2018-04-131-52/+12
| | | | | | | | | | | | Reuse the existing enum type for ipv6.ip6-privacy instead of defining custom get and set functions. It is now possible to set the enum to "unknown".
| * clients: meta: add enum getter-only nicksBeniamino Galvani2018-04-132-2/+6
| | | | | | | | | | | | | | Add a new a new field to enum type descriptors that specify a list of nicks valid only for getter functions. It is useful when the get function must return a string different from the enum nick and that string can't be used to set a value.
| * shared: use value infos in _nm_utils_enum_to_str_fullBeniamino Galvani2018-04-134-13/+43
|/
* auth-subject: fix potential memory corruption in nm_auth_subject_to_string()Thomas Haller2018-04-131-2/+2
| | | | | | | | | | | | | | We don't want to apped the value to @buf, we want to set it. Also, if @buf happens to be uninitialized, g_strlcat() might determine there is nothing to append and return the buffer unmodified. Then, the (non NULL terminated) buffer might be printed. Note that before recent refactoring, we effectively would only call nm_auth_subject_to_string() on auth-subjects that were of type UNIX-PROCESS. Hence, this bug came only to light very recently, although it was present for a long time. Fixes: eabe7d856c243673bbaba3295ce74d72e188596d
* policy: fix potential leak of subject in auto_activate_device()Thomas Haller2018-04-131-3/+1
|
* settings: return empty connections list on D-Bus util connections are loadedThomas Haller2018-04-131-5/+8
| | | | | | | We also don't emit the PropertiesChanged signal while connections are not loaded. Maybe that is wrong, in any case, the property should agree with the way how we emit notifications. So, for now, make the property agree with not notifying about connections during startup.
* settings: fix clearing agent-manager in NMSettings' dispose()Thomas Haller2018-04-131-2/+2
| | | | | dispose() should be re-entrant. When releasing a resource, it must not leave a dangling pointer. While at it, just move it to finalize() instead.
* settings: use cleanup-attribute in send_agent_owned_secrets()Thomas Haller2018-04-131-2/+1
|
* settings: fix leaking connection in NMSettings' connection_removed()Thomas Haller2018-04-131-1/+2
| | | | | | | Also, take a reference of the NMSettingsConnection while it is being tracked by NMSettings' list. Fixes: 1f3b47deea84888813ed482f5b3e75292b0f2726
* core/trivial: adjust code commentThomas Haller2018-04-131-1/+1
|
* all: unify spelling of translators hint in source codeThomas Haller2018-04-1371-270/+270
| | | | | | | | | Use the same form everywhere: "TRANSLATORS" instead of "Translators". The manual also seems to prefer the upper-case form [1]. $ sed 's/\<Translators\>: /TRANSLATORS: /g' $(git grep -l Translators) -i [1] https://www.gnu.org/software/gettext/manual/gettext.html
* core: merge branch 'th/settings-cleanup'Thomas Haller2018-04-1328-969/+1247
|\ | | | | | | https://github.com/NetworkManager/NetworkManager/pull/85
| * auth-chain: create data-hash hashtable only when neededThomas Haller2018-04-131-4/+13
| | | | | | | | | | | | | | | | It makes sense to use NMAuthChain also when not attaching any user-data to the chain. The main reason would be, the ability to schedule multiple permission checks in parallel, and wait for them to complete together. Only allocate the hash-table, when we really need it.
| * auth-chain/trivial: rename data field in NMAuthChainThomas Haller2018-04-131-8/+8
| | | | | | | | | | We already use "data" for other places. Let's use unique names that can be searched within one file.
| * core: don't use NMAuthChain in NMActiveConnection but directly schedule eventsThomas Haller2018-04-131-60/+101
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | More of a proof of concept, how convenient (or not) it is to drop NMAuthChain and use NMAuthManager's API directly. I think it's reasonably nice. As before, when asking for both general network-control permissions and wifi-shared-permissions, we will not fail with wifi-shared-permissions, as long as network-control check is still pending. The effect is, that the error response preferably complains about no permissions to network-control (in case both permissions are missing). One change in behavior is, if network-control authorization check fails before wifi-shared-permissions, we declare the result and cancel the pending wifi-shared-permissions. Previously, we would have waited for both results. The change in behavior is not merely that we declare the result earlier, but also that NMAuthManager will actively send a "CancelCheckAuthorization" D-Bus call to cancel the still pending wifi-shared-permissions check.
| * auth-chain: drop logging in NMAuthChain when request failsThomas Haller2018-04-131-6/+0
| | | | | | | | | | | | | | For one, we already do <trace> level logging inside NMAuthManager. So, at trace level we have everything. If a request fails, it's not up to NMAuthChain to log a warning.
| * settings: rework scheduling of authorization requests in settings-connectionThomas Haller2018-04-131-65/+74
| | | | | | | | | | | | | | | | | | Get rid of the NMAuthChain layer. I think NMAuthChain only makes sense if we schedule multiple requests together for the same topic. But NMSettingsConnection never does that: each D-Bus request corresponds to only one polkit authorization request. So, we can just call NMAuthManager directly.
| * settings: cancel pending authorization requests if connection gets removedThomas Haller2018-04-131-0/+8
| | | | | | | | | | | | | | Otherwise, the autorization request might succeed and we would still do something with the connection that is already removed. https://bugzilla.redhat.com/show_bug.cgi?id=1565030
| * auth-manager: add helper function nm_auth_call_result_eval()Thomas Haller2018-04-133-17/+30
| | | | | | | | | | | | | | This makes NMAuthCallResult not only usable from within a NMAuthChain. It makes sense to just call nm-auth-manager directly, but then we need a way to convert the more detailed result into an NMAuthCallResult value.
| * auth-manager: let NMAuthChain always call to NMAuthManager for dummy requestsThomas Haller2018-04-132-42/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NMAuthChain's nm_auth_chain_add_call() used to add special handling for the NMAuthSubject. This handling really belongs to NMAuthManager for two reasons: - NMAuthManager already goes through the effort of scheduling an idle handler to handle the case where no GDBusProxy is present. It can just as well handle the special cases where polkit-auth is disabled or when we have internal requests. - by NMAuthChain doing special handling, it makes it more complicated to call nm_auth_manager_check_authorization() directly. Previously, the NMAuthChain had additional logic, which means you either were forced to create an NMAuthChain, or you had to reimplement special handling like nm_auth_chain_add_call().
| * auth-manager: always compile D-Bus calls to polkitThomas Haller2018-04-135-57/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Supporting PolicyKit required no additional library, just extra code to handle the D-Bus calls. For that, there was a compile time option to even stip out that code. Note, that you could (and still can) configure the system not to use policy-kit. The point was to reduce the binary size in case you don't need it. Remove this. I guess, we we aim for such aggressive optimization of the binary size, we should instead make all device types disablable at configuration time. We don't do that either and other low hanging fruits, because it's better to always enable features, unless they require external dependencies. Also, the next commit will make more use of NMAuthManager. So, having it disabled at compile time, makes even less sense.
| * auth-manager: rework auth-manager's APIThomas Haller2018-04-133-279/+359
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't use the GAsyncResult pattern for internal API of auth-manager. Instead, use a simpler API that has a more strict API and simpler use. - return a call-id handle when scheduling the authorization request. The request is always scheduled asynchronsously and thus call-id is never %NULL. - the call-id can be used to cancel the request. It can be used exactly once, and only before the callback is invoked. - the async keeps the auth-manager alive. It needs to do so, because when cancelling the request we might not yet be done: instead we might still need to issue a CancelCheckAuthorization call (which we need to handle as well). - the callback is always invoked exactly once. Currently NMAuthManager's API effectivly is only called by NMAuthChain. The point of this is to make NMAuthManager's API more consumable, and thus let users use it directly (instead of using the NMAuthChain layer). As well known, we don't do a good job during shutdown of NetworkManager to release all resources and cancel pending requests. This rework also makes it possible to actually get this right. See the comment in nm_auth_manager_force_shutdown(). But yes, it is still a bit complicated to do a controlled shutdown, because we cannot just synchronously complete. We need to issue CancelCheckAuthorization D-Bus calls, and give these requests time to complete. The new API introduced by this patch would make that easier.
| * auth-manager: drop unused property getter for NM_AUTH_MANAGER_POLKIT_ENABLEDThomas Haller2018-04-131-18/+2
| | | | | | | | | | | | We need the setter, because we want that the property is set only once during creation of the instance. Nobody cares about the GObject property getter otherwise.
| * auth-manager: emit signal by IDThomas Haller2018-04-131-1/+1
| | | | | | | | | | | | | | It's more efficient, as it saves a lookup by name. Also, it's more idiomatic to do it this way. I didn't find where the signal gets emitted at first, because usually we don't emit by name.
| * auth-chain: avoid another idle-call when auth-request completesThomas Haller2018-04-132-16/+14
| | | | | | | | | | | | | | | | | | | | | | NMAuthChain schedules (possibly) multiple authentication requests. When they all complete, it will once invoke the result-callback. There is no need to schedule this result-callback on another idle-handler, because nm_auth_manager_polkit_authority_check_authorization() should guarantee to invoke the callback never-synchronously and on a clean call-stack (to avoid problems with re-entrancy). At that point, NMAuthChain does not need to delay this further.
| * auth-chain/trivial: rename nm_auth_chain_unref() to nm_auth_chain_destroy()Thomas Haller2018-04-137-29/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NMAuthChain is not really ref-counted. True, we have an internal ref-counter to ensure that the instance stays alive while the callback is invoked. However, the user cannot take additional references as there is no nm_auth_chain_ref(). When the user wants to get rid of the auth-chain, with the current API it is important that the callback won't be called after that point. From the name nm_auth_chain_unref(), it sounds like that there could be multiple references to the auth-chain, and merely unreferencing the object might not guarantee that the callback is canceled. However, that is luckily not the case, because there is no real ref-counting involved here. Just rename the destroy function to make this clearer.
| * core: use NMDBusTrackObjPath for NM_DEVICE_ACTIVE_CONNECTION pathThomas Haller2018-04-131-61/+44
| |
| * core: use NMDBusTrackObjPath for NM_DEVICE_PARENT pathThomas Haller2018-04-131-19/+18
| |
| * core: use NMDBusTrackObjPath for NM_ACTIVE_CONNECTION_CONNECTION pathThomas Haller2018-04-131-39/+47
| |
| * core: add NMDBusTrackObjPath helperThomas Haller2018-04-132-0/+129
| | | | | | | | | | | | | | | | | | When one D-Bus object exposes (the path of) another D-Bus object, we want that the path property gets cleared before the other object gets unexported(). That essentially requires to register to the "exported-changed" signal. Add a helper struct NMDBusTrackObjPath to help with this.
| * settings: track connections via CListThomas Haller2018-04-134-131/+118
| |
View Lorry Controller Status