Note that POSIX select() can only handle up to 1024 descriptors. That
means, our code (and the libraries that we use) must not use select().

Note that libndp uses select(), which means NetworkManager will crash
when using file descriptors larger than 1023. On the other hand,
depriving NetworkManager of file descriptors will also crash it.
So libndp must be fixed ([1]).

[1] https://listman.redhat.com/archives/libndp-list/2021-February/msg00000.html

https://bugzilla.redhat.com/show_bug.cgi?id=1926599

The previous URL http://www.gnome.org/projects/NetworkManager/
now redirects to https://wiki.gnome.org/Apps, which isn't very
useful.

Instead, link to our NetworkManager page. The page is still sparsely
populated, but we should improve that.

Well, that was short. Seems we need CAP_DAC_OVERRIDE at least for the
OVS plugin. The OVS socket is

  srwxr-x---. 1 openvswitch openvswitch 0 Xxx xx xx:xx /run/openvswitch/db.sock

and without CAP_DAC_OVERRIDE, NetworkManager cannot talk to OVS.

We should fix that differently by adding a nm-sudo D-Bus service that
can hand a file descriptor to NetworkManager.

This reverts commit 2e334f54b27f91f40c3aa8bdba3254e2284d30bd.

https://bugzilla.redhat.com/show_bug.cgi?id=1921826

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/742

These SPDX license identifiers are deprecated ([1]). Update them.

[1] https://spdx.org/licenses/

  sed \
     -e '1 s%^/\* SPDX-License-Identifier: \(GPL-2.0\|LGPL-2.1\)+ \*/$%/* SPDX-License-Identifier: \1-or-later */%' \
     -e '1,2 s%^\(--\|#\|//\) SPDX-License-Identifier: \(GPL-2.0\|LGPL-2.1\)+$%\1 SPDX-License-Identifier: \2-or-later%' \
     -i \
     $(git grep -l SPDX-License-Identifier -- \
         ':(exclude)shared/c-*/' \
         ':(exclude)shared/n-*/' \
         ':(exclude)shared/systemd/src' \
         ':(exclude)src/systemd/src')

> If there is no network [1] to connect to (if network interface is down [2])
> NetworkManager will make "nm-online -s" stop [3] without waiting.

[1] we usually talk about connection profiles or devices/interfaces
[2] it would be better to say, if no suitable profile is ready to
  autoconnect.
[3] `nm-online -s` waits until NetworkManager declares "startup
complete" reached.

I find the wording of the comment not very clear or useful.
Possibly I don't understand it properly, but that is a problem
for a comment that is supposed to help.

Remove it.

We encountered the following situation:
* nm-online (NetworkManager-wait-online.service) is started
* NetworkManager tries to configure network
* the first try of using dhclient fails with timeout for some reasons
* the second try of running dhclient completes successfully (NMs tries himself)
We get a working network, but it takes more that 30 seconds.

NetworkManager-wait-online.service fails, it may be a false negative
to checkers of network being online. It will also be a false positive signal
to start mounting network (CIFS, NFS etc.) shares, for example, because
they depend from network-online.target and network-online.target will become
reached right after NetworkManager-wait-online.service fails.

So, it makes sense to increase default timeout from 30 to 60 seconds.

@thaller wrote in https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/237
that there may be cases where, for example, incorrectly set up bridges
or just network may lead to delays when booting the system.

Yes, but:
* if there is no possibility to start trying to connect the network, e.g. if all network interfaces,
  managed by NetworkManager, are DOWN, NM will not try to connect network and "nm-online -s" will
  exit with 0 without waiting (so, this will not prolong start up of workstations or servers
  when ethernet cable is just not plugged in)
* an additional potential 30 seconds delay seems to be less harmful then a false positive to start
  mounting network shares or doing abything else too eraly, when an additional wait for a few seconds
  would have prevented those things from failing.

All things considered, it seems reasonable to increase this timeout from 30 seconds to 1 minute (60 seconds).

Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/675

SSH seems one of the few really trusted processes. It is even
allowed for the public zone. Allow it in "nm-shared" zone too.

Install a NM-specific firewalld zone to be used for interfaces that
are used for connection sharing. The zone blocks all traffic to the
local machine except some protocols (DHCP, DNS and ICMP) and allows
all forwarded traffic.

https://bugzilla.redhat.com/show_bug.cgi?id=1828458

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/484
(cherry picked from commit e468b48ab7b8e2ddc8802db4b93e3f13787835e4)