Author: Kees Cook
Author Date: 2021-10-21 07:47:26 UTC

networkd:wpa_supplicant: driver fallback to nl80211 and/or wext (LP: #1814012) (#240)

Adds tests to check the generated content of the wpa_supplicant .service files.

Fixes non-wired wpa_supplicant .service definition to use correct driver fallback list:

The default behavior for wpa_supplicant under systemd is to try both
nl80211 and wext drivers[1]. However, netplan was not specifying the
the same configuration, so wext devices had no way to be configured[2].

[1] https://salsa.debian.org/debian/wpa/-/blob/debian/unstable/debian/patches/networkd-driver-fallback.patch
[2] https://bugs.launchpad.net/netplan/+bug/1814012

Signed-off-by: Kees Cook kees@ubuntu.com

COMMITS:
* networkd: Add missing umask(022) for wpa_supplicant .service generator

While expanding the generator tests, I noticed that the .service files
being generated were being written world-writable (mode 0666). It seems
only the wpa_supplicant .service generator was missing the umask(022)
call used everywhere else (but nothing was testing for this).

Luckily it seems that netplan when running for real uses a umask of 022
so .service files are (accidentally) not currently be written with mode
0666 in production that I could find.

Add missing umask(022) call so even if the running umask breaks,
the files won't be world-writable (which would likely lead to a local
privilege escalation vulnerability for any systems configuring a "wifis"
netplan section).

Signed-off-by: Kees Cook <kees@ubuntu.com>

* tests: Check contents of .service file for wpa_supplicant

There was no content checking of the generated wpa_supplicant .service
files. Add a templated check for this, leaving the '-D' option
open-coded here, to be changed with the next patch.

Signed-off-by: Kees Cook <kees@ubuntu.com>

* wifis: Specify wpa_supplicant driver fallback

The default behavior for wpa_supplicant under systemd is to try both
nl80211 and wext drivers[1]. However, netplan was not specifying the
same configuration, so wext devices had no way to be configured[2] by
netplan.

Add -Dnl80211,wext to the wpa_supplicant generated .service file and
update tests accordingly.

[1] https://salsa.debian.org/debian/wpa/-/blob/debian/unstable/debian/patches/networkd-driver-fallback.patch
[2] https://bugs.launchpad.net/netplan/+bug/1814012

Signed-off-by: Kees Cook <kees@ubuntu.com>

Author: Lukas Märdian
Author Date: 2021-10-11 10:24:29 UTC

nm: Do not set missing gateway as unspecified address

Also avoid the deprecated trailing comma notation at the same time.

Author: Lukas Märdian
Author Date: 2021-10-01 10:39:40 UTC

generate:dbus:util: glib 2.70 compat

g_spawn_check_exit_status is deprecated since libglib 2.70 and replaced
by g_spawn_check_wait_status

Author: Lukas Märdian
Author Date: 2021-09-27 14:31:46 UTC

cli:apply:clear_virtual_links: make devices a named parameter

Author: Michael Hudson-Doyle
Author Date: 2021-09-07 09:27:16 UTC

Fix ethernets test with network-manage 1.32.10

NetworkManager's udev rules are smarter about catching renamed veths now, so
the udev rule the integration tests use to manage their veths need to list the
names the veths are renamed to too.

Author: Lukas Märdian
Author Date: 2021-07-06 16:08:07 UTC

test:parser: improve base class naming

Author: Lukas Märdian
Author Date: 2021-04-08 14:16:23 UTC

tests:wifi:scenarios: fixes for Hotspot and Bridge

Author: Lukas Märdian
Author Date: 2021-06-18 15:24:46 UTC

netplan: clear whitespace

Delete duplicated empty line in the netplan YAML generator.

Co-authored-by: Łukasz Zemczak <sil2100@vexillium.org>

Author: Lukas Märdian
Author Date: 2021-06-14 14:50:46 UTC

Merge branch 'master' into slyon/fix-integration-tests

Author: Lukas Märdian
Author Date: 2021-06-14 14:39:01 UTC

Merge branch 'master' into slyon/fix-sbin

Author: Łukasz Zemczak
Author Date: 2021-05-26 13:51:35 UTC

Merge branch 'master' into admin-status

Author: Lukas Märdian
Author Date: 2021-05-10 09:07:25 UTC

doc: update tunnel_ttl documentation

Author: Lukas Märdian
Author Date: 2021-05-05 15:07:57 UTC

generate: disable generation of non-NM config

Author: Lukas Märdian
Author Date: 2021-05-05 10:15:43 UTC

cli: SNAP special handling: improve test coverage and error handling

Author: Lukas Märdian
Author Date: 2021-05-03 12:36:41 UTC

doc: mention Netplan.Generate() DBus method

Author: Lukas Märdian
Author Date: 2021-04-27 09:30:31 UTC

cli:set: use shutil.copy2()

Author: Lukas Märdian
Author Date: 2021-03-15 11:15:28 UTC

cli:set: check GLOBAL_KEYS dynamically

Author: Łukasz Zemczak
Author Date: 2021-03-08 16:02:07 UTC

Merge branch 'master' into slyon/networkmanager-yaml-backend

Author: Lukas Märdian
Author Date: 2021-02-24 14:09:41 UTC

fixes

Author: Lukas Märdian
Author Date: 2021-02-24 11:27:56 UTC

tests: add full cycle keyfile-YAML-keyfile test for Hotspot mode

Author: Lukas Märdian
Author Date: 2021-02-24 09:12:03 UTC

Update Github URL

Author: Łukasz Zemczak
Author Date: 2021-02-19 15:34:05 UTC

Merge branch 'master' into slyon/lp1913062

Author: Lukas Märdian
Author Date: 2021-02-19 12:18:18 UTC

parse: avoid creation of 'netdefs' hashmap in netplan_parse_yaml

Author: Lukas Märdian
Author Date: 2021-02-16 09:18:30 UTC

doc: mention the device type

Author: Lukas Märdian
Author Date: 2021-01-28 11:17:15 UTC

serialize: cleanup formatting

Author: Lukas Märdian
Author Date: 2021-01-19 10:06:28 UTC

nm: uses alias for 'ethernet', 'wifi' and 'wifi-security'

NetworkManager writes the alias for 'ethernet' (802-3-ethernet), 'wifi' (802-11-wireless) and 'wifi-security' (802-11-wireless-security) settings by default since a long time, we should do so as well. Especially we should not mix and match.

see: https://bugzilla.gnome.org/show_bug.cgi?id=696940
see: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/c36200a225aefb2a3919618e75682646899b82c0
see: nm_keyfile_plugin_kf_set* from nm-keyfile-utils.c (libnm-core)

Author: Lukas Märdian
Author Date: 2021-01-15 14:36:56 UTC

util: move netplan_delete_connection and netplan_generate from parse.c

Author: Lukas Märdian
Author Date: 2021-01-13 13:49:37 UTC

util: move netplan_get_id_from_nm_filename from parse.c

Author: Lukas Märdian
Author Date: 2020-11-26 10:27:28 UTC

cli: update comment about NamePolicy=keep rename

Author: Lukas Märdian
Author Date: 2020-11-20 12:27:05 UTC

dbus: tests: some minimal refactoring

Author: Lukas Märdian
Author Date: 2020-09-30 09:13:51 UTC

cli:set: catch invalid input exception

Author: Lukas Märdian
Author Date: 2020-08-28 20:43:20 UTC

cli:apply: clear netplan-ovs-cleanup.service only if available

Author: Łukasz Zemczak
Author Date: 2020-06-30 16:42:13 UTC

Add a quick paragraph about OVS and fake VLAN bridges.

Author: Łukasz Zemczak
Author Date: 2020-06-05 09:45:18 UTC

Add tests for coverage, update docs and add OpenFlow16 support for the future.

Author: Łukasz Zemczak
Author Date: 2020-05-20 14:16:13 UTC

100% coverage, add support for global mapping, fixes/improvements per Lukas's review.

Author: Lukas Märdian
Author Date: 2020-05-19 10:08:33 UTC

nm: silently ignore default 'global' scope

Error out if the scope was changed manually

Author: Lukas Märdian
Author Date: 2020-05-11 07:31:41 UTC

Fix invalid bond mode SRU regression (LP: #1877643)

netplan < 0.98 accepted invalid bond modes, we should _not_ reject such
configs, even though they are invalid, to avoid regressions in stables releases.

This affects the bionic stable release, as the original version in this
release shipped netplan < 0.98.

Author: Łukasz Zemczak
Author Date: 2020-04-09 19:11:24 UTC

Fix bug found in hardware testing: fix having multiple VFs for a PF that has match: in it

Author: Lukas Märdian
Author Date: 2020-04-07 13:14:25 UTC

NM:bridge:vlan: enable vlan-filtering on bridge, if vlans are set

Author: Lukas Märdian
Author Date: 2020-03-24 13:49:05 UTC

parse: mark internal vars as static

Signed-off-by: Lukas Märdian <lukas.maerdian@canonical.com>

Author: Mathieu Trudel-Lapierre
Author Date: 2019-11-27 18:07:32 UTC

Merge branch 'master' into network-link-mtu

Author: Łukasz Zemczak
Author Date: 2019-11-19 13:07:47 UTC

Add example for a directly-connected gateway on IPv6.

Author: Mathieu Trudel-Lapierre
Author Date: 2019-08-19 19:10:29 UTC

Merge branch 'master' into doc-features

Author: Mathieu Trudel-Lapierre
Author Date: 2019-08-15 13:07:39 UTC

Merge branch 'master' into netplan-info

Author: Mathieu Trudel-Lapierre
Author Date: 2019-07-26 17:32:55 UTC

Merge branch 'master' into hashed-passwords

Author: Mathieu Trudel-Lapierre
Author Date: 2019-04-30 18:57:11 UTC

parser: refactor / factor out validation and error reporting

Move validation and error reporting to their own files; also rework
the validation passes slightly to validate as much as we can of the
netplan grammar in parser passes (so we get context info for errors),
and leave the backend rules sanity checking only to after the parsing.

This way we'll get the error context, unless things are backend-specific
rules for which it's just hard to get the info (and not as helpful).

Author: Mathieu Trudel-Lapierre
Author Date: 2019-03-21 17:28:08 UTC

Clean up lint errors and stray debug messages that aren't useful

Author: Mathieu Trudel-Lapierre
Author Date: 2019-03-18 21:44:12 UTC

Also configure physical interfaces without carrier

Author: Mathieu Trudel-Lapierre
Author Date: 2019-02-26 21:58:08 UTC

NetworkManager 1.15.2 wants keyfiles in /run to have the .nmconnection extension (LP: #1817655)

This appeared in NM upstream as 648c256b9014198aac388097e410999c68c4b452; and
previous versions of NetworkManager do not seem to care, so land the changes in
general, without changes for previous Ubuntu releases.

Adjust tests so they still work with this change.

Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>

Author: Mathieu Trudel-Lapierre
Author Date: 2019-02-22 13:28:34 UTC

netplan-wpa@.service shouldn't have DefaultDependencies=no, otherwise it starts late

Author: Mathieu Trudel-Lapierre
Author Date: 2019-02-12 00:04:49 UTC

Fix up integration tests runner to correctly report failures

Author: Mathieu Trudel-Lapierre
Author Date: 2018-12-12 20:06:41 UTC

doc: drop 802.1x extra unused 'psk' key now that it's merged in password

Author: Mathieu Trudel-Lapierre
Author Date: 2018-12-12 17:02:04 UTC

Merge branch 'master' into doc-revision

Author: Mathieu Trudel-Lapierre
Author Date: 2018-12-11 19:44:24 UTC

Merge branch 'master' into use-routes

Author: Mathieu Trudel-Lapierre
Author Date: 2018-12-11 00:20:12 UTC

integration: create a test runner so our integration tests can be reused

Author: Mathieu Trudel-Lapierre
Author Date: 2018-12-08 02:28:41 UTC

integration/ethernets: fix imports for dnsmasq/resolved integration

Author: Mathieu Trudel-Lapierre
Author Date: 2018-12-07 17:11:41 UTC

Merge branch 'master' into tunnels

Author: Mathieu Trudel-Lapierre
Author Date: 2018-12-07 17:01:26 UTC

Merge branch 'master' into lp1804861

Author: Mathieu Trudel-Lapierre
Author Date: 2018-11-29 00:33:54 UTC

generator tests: remove shebangs, clean up importing

Author: Mathieu Trudel-Lapierre
Author Date: 2018-11-21 19:43:27 UTC

releasing package netplan.io version 0.40.1~18.04.3

Author: Mathieu Trudel-Lapierre
Author Date: 2018-11-21 19:29:22 UTC

releasing package netplan.io version 0.40.2.2

Author: Mathieu Trudel-Lapierre
Author Date: 2018-11-09 20:47:02 UTC

Add integration tests for rename bug LP: #1802322

Author: Mathieu Trudel-Lapierre
Author Date: 2018-10-22 19:23:46 UTC

Correctly deref parser when looking up error context

Author: Mathieu Trudel-Lapierre
Author Date: 2018-06-29 17:29:49 UTC

releasing package nplan version 0.32~16.04.6

Author: Mathieu Trudel-Lapierre
Author Date: 2018-05-29 15:19:07 UTC

tests: add error test for missing 'to' for a link scope route

Author: Mathieu Trudel-Lapierre
Author Date: 2018-05-23 01:44:38 UTC

WIP: detect naming changes and apply them

If the iface is up, just do net_setup_link; otherwise run 'ip link set'.

Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>

Author: Mathieu Trudel-Lapierre
Author Date: 2018-05-11 13:57:56 UTC

networkd: always write .network files for some parameters

Author: Mathieu Trudel-Lapierre
Author Date: 2018-05-07 15:42:14 UTC

yaml: add "critical" boolean field which can be set for remote-root scenarios

'critical: true' in YAML would set "CriticalConnection=true" in
systemd-networkd config; this is useful for remote-root scenarios where
restarting networkd would otherwise risk releasing the IP from the DHCP server,
leading to a hung system.

Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>

Author: Mathieu Trudel-Lapierre
Author Date: 2018-04-17 18:57:32 UTC

terminal: disable echo while we're waiting for timeout/user input

Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>

Author: Ryan Harper
Author Date: 2018-04-10 23:30:40 UTC

accept-ra: do not enable by default, default to unset

Do not always emit an IPv6AcceptRA value into network configurations.
Systemd-networkd defaults to kernel value as long as the value stays
unset in the configuration. When IPv6AcceptRA is enabled in systemd
this makes networkd wait 10 seconds for potential RAs to arrive. This
delays boot by 10 seconds always whether or not the network has an
IPV6 Router running. Leaving things unsets keeps existing behavior
of Ubuntu systems where RAs are accepted and processed at the time
they are received and boot is not delayed by waiting for an RA to arrive.

If users want to forcibly enable or disable, they may do so by including
a value for accept-ra in their yaml configuraion.

LP: #1732002

Author: Mathieu Trudel-Lapierre
Author Date: 2018-03-27 17:33:36 UTC

tests: add generate/error tests for dhcp-identifier: field

Author: Mathieu Trudel-Lapierre
Author Date: 2017-11-16 15:43:55 UTC

releasing package nplan version 0.32~17.04.1

Author: Mathieu Trudel-Lapierre
Author Date: 2017-06-07 00:35:04 UTC

releasing package nplan version 0.23~16.10.1