Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-119641

NM doesn't export nm-auto-defaults = no field from vpn.data

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • No
    • None
    • rhel-net-mgmt
    • 3
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • Hide

      Definition of Done:

      Please mark each item below with ( / ) if completed or ( x ) if incomplete:

      ( ) The acceptance criteria defined below are met.

      Given a sysadmin configures a VPN connection using nmcli with nm-auto-defaults=no, 
      When they run "nmcli connection export <connection-name>", 
      Then the exported libreswan conf file should include:
        - # nm-auto-defaults parameter (it has PARAM_IGNORE flag)
        - contain all parameters from vpn.data that are marked exportable
        
      —
      Given a sysadmin configures a VPN connection using nmcli with nm-auto-defaults=no,
      When they export the connection and then import it back,
      Then the imported connection should:
        - Have nm-auto-defaults=no behavior (no automatic defaults)
        - Contain the same explicitly set parameters as the original
        - NOT contain any automatically added default values

      ( ) Code is reviewed and merged upstream.

      ( ) Preliminary testing is done.

      ( ) A demo is recorded

      Show
      Definition of Done: Please mark each item below with ( / ) if completed or ( x ) if incomplete: ( ) The acceptance criteria defined below are met. Given a sysadmin configures a VPN connection using nmcli with nm-auto-defaults=no,  When they run "nmcli connection export <connection-name>",  Then the exported libreswan conf file should include:   - # nm-auto-defaults parameter (it has PARAM_IGNORE flag)   - contain all parameters from vpn.data that are marked exportable    — Given a sysadmin configures a VPN connection using nmcli with nm-auto-defaults=no, When they export the connection and then import it back, Then the imported connection should:   - Have nm-auto-defaults=no behavior (no automatic defaults)   - Contain the same explicitly set parameters as the original   - NOT contain any automatically added default values ( ) Code is reviewed and merged upstream. ( ) Preliminary testing is done. ( ) A demo is recorded
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      ```

      [root@wifi4-ml5-vm5 NetworkManager-ci]# nmcli connection add type vpn con-name VPNX ifname '*' autoconnect no vpn-type libreswan vpn.data 'right=1.2.3.4, rightid=@server, rightrsasigkey=server-key, left=1.2.3.5, leftid=@client, leftrsasigkey=client-key, leftcert=client-cert, ike=aes256-sha1;modp1536, esp=aes256-sha1, nm-auto-defaults=no'
      Connection 'VPNX' (fd7a7e65-1271-4e84-9325-e7db425cf4c6) successfully added.
      [root@wifi4-ml5-vm5 NetworkManager-ci]# nmcli  connection export VPNX > /tmp/VPNX.txt
      [root@wifi4-ml5-vm5 NetworkManager-ci]# cat /tmp/VPNX.txt
      conn VPNX
       right=1.2.3.4
       leftid=@client
       rightid=@server
       leftcert="client-cert"
       rightrsasigkey="server-key"
       leftrsasigkey="client-key"
       left=1.2.3.5
       ike=aes256-sha1;modp1536

      ```

      Check that nm-auto-defaults is not exported. Upon other imports, we have all NM-libreswan defaults back in. This is not what the user expects. 

      so to solve this:

      [root@wifi4-ml5-vm5 NetworkManager-ci]# echo "nm-auto-defaults=no" >> /tmp/VPNX.txt

      [root@wifi4-ml5-vm5 NetworkManager-ci]# nmcli con import file /tmp/VPNX.txt type libreswan
      Connection 'VPNX' (a908bf54-5104-4aee-b75c-6ce4f72a1d26) successfully added.

      [root@wifi4-ml5-vm5 NetworkManager-ci]# nmcli connection show VPNX |grep nm-auto-defaults
      vpn.data:                               ike = aes256-sha1;modp1536, left = 1.2.3.5, leftcert = client-cert, leftid = @client, leftrsasigkey = client-key, nm-auto-defaults = no, right = 1.2.3.4, rightid = @server, rightrsasigkey = server-key

       

      but w/o it:

      [root@wifi4-ml5-vm5 NetworkManager-ci]# nmcli connection show VPNX |grep data
      vpn.data:                               ike = aes256-sha1;modp1536, ikelifetime = 24h, ikev2 = never, left = 1.2.3.5, leftcert = client-cert, leftid = @client, leftmodecfgclient = yes, leftrsasigkey = client-key, rekey = yes, right = 1.2.3.4, rightid = @server, rightrsasigkey = server-key, rightsubnet = 0.0.0.0/0, salifetime = 24h

       

      so this is the other behaviour.

      What is the impact of this issue to you?

      Please provide the package NVR for which the bug is seen:

      NetworkManager-libreswan-1.2.27-1.el10.x86_64

      How reproducible is this bug?:

      always

      Steps to reproduce

      1. as described above
      2.  
      3.  

      Expected results

      Consistent export and import

      Actual results

      Inconsistent export and import

       

              nm-team Network Management Team
              rhn-engineering-vbenes Vladimir Benes
              Network Management Team Network Management Team
              Vladimir Benes Vladimir Benes
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: