core: merge branch 'th/mlag-bonding-slb' (part 2)

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1385

(cherry picked from commit c5beec90a8f2fa79984b036c598940c22b510777)

(cherry picked from commit 278d32c7e79ab6484c80e7f2709f731671ba7bb8)

5 files changed, 57 insertions, 12 deletions

diff --git a/src/core/devices/nm-device-private.h b/src/core/devices/nm-device-private.h
index b54aed6a75..31424d5c2b 100644
--- a/src/core/devices/nm-device-private.h
+++ b/src/core/devices/nm-device-private.h
@@ -89,7 +89,10 @@ nm_device_devip_set_state(NMDevice             *self,
     nm_assert(NM_IS_DEVICE(self));
     nm_assert_addr_family_or_unspec(addr_family);
     nm_assert(!l3cd || NM_IS_L3_CONFIG_DATA(l3cd));
-    nm_assert(NM_IN_SET(ip_state, NM_DEVICE_IP_STATE_PENDING, NM_DEVICE_IP_STATE_READY));
+    nm_assert(NM_IN_SET(ip_state,
+                        NM_DEVICE_IP_STATE_NONE,
+                        NM_DEVICE_IP_STATE_PENDING,
+                        NM_DEVICE_IP_STATE_READY));
 
     nm_device_devip_set_state_full(self, addr_family, ip_state, l3cd, NM_DEVICE_STATE_REASON_NONE);
 }
diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
index 888b03c68c..5ec7fb34f5 100644
--- a/src/core/devices/nm-device.c
+++ b/src/core/devices/nm-device.c
@@ -9736,6 +9736,7 @@ nm_device_devip_set_state_full(NMDevice             *self,
 
     nm_assert_addr_family_or_unspec(addr_family);
     nm_assert(NM_IN_SET(ip_state,
+                        NM_DEVICE_IP_STATE_NONE,
                         NM_DEVICE_IP_STATE_PENDING,
                         NM_DEVICE_IP_STATE_READY,
                         NM_DEVICE_IP_STATE_FAILED));
@@ -9743,7 +9744,7 @@ nm_device_devip_set_state_full(NMDevice             *self,
 
     nm_assert((ip_state != NM_DEVICE_IP_STATE_FAILED)
               == (failed_reason == NM_DEVICE_STATE_REASON_NONE));
-    nm_assert((ip_state != NM_DEVICE_IP_STATE_FAILED) || !l3cd);
+    nm_assert(NM_IN_SET(ip_state, NM_DEVICE_IP_STATE_PENDING, NM_DEVICE_IP_STATE_READY) || !l3cd);
 
     p = _dev_ipdev_data(self, addr_family);
 
diff --git a/src/core/nm-firewall-utils.c b/src/core/nm-firewall-utils.c
index 3752928d94..e482ab9684 100644
--- a/src/core/nm-firewall-utils.c
+++ b/src/core/nm-firewall-utils.c
@@ -430,14 +430,21 @@ _fw_nft_call_communicate_cb(GObject *source, GAsyncResult *result, gpointer user
     } else if (g_subprocess_get_successful(call_data->subprocess)) {
         nm_log_dbg(LOGD_SHARING, "firewall: nft[%s]: command successful", call_data->identifier);
     } else {
+        char          buf[NM_UTILS_GET_PROCESS_EXIT_STATUS_BUF_LEN];
         gs_free char *ss_stdout    = NULL;
         gs_free char *ss_stderr    = NULL;
         gboolean      print_stdout = (stdout_buf && g_bytes_get_size(stdout_buf) > 0);
         gboolean      print_stderr = (stderr_buf && g_bytes_get_size(stderr_buf) > 0);
+        int           status;
+
+        status = g_subprocess_get_status(call_data->subprocess);
+
+        nm_utils_get_process_exit_status_desc_buf(status, buf, sizeof(buf));
 
         nm_log_warn(LOGD_SHARING,
-                    "firewall: nft[%s]: command failed:%s%s%s%s%s%s%s",
+                    "firewall: nft[%s]: command %s:%s%s%s%s%s%s%s",
                     call_data->identifier,
+                    buf,
                     print_stdout || print_stderr ? "" : " unknown reason",
                     NM_PRINT_FMT_QUOTED(
                         print_stdout,
@@ -455,6 +462,8 @@ _fw_nft_call_communicate_cb(GObject *source, GAsyncResult *result, gpointer user
                                                            &ss_stderr),
                         "\")",
                         ""));
+
+        nm_utils_error_set(&error, NM_UTILS_ERROR_COMMAND_FAILED, "nft command %s", buf);
     }
 
     _fw_nft_call_data_free(call_data, g_steal_pointer(&error));
@@ -610,6 +619,14 @@ _fw_nft_call_sync(GBytes *stdin_buf, GError **error)
 
 #define _append(p_strbuf, fmt, ...) nm_str_buf_append_printf((p_strbuf), "" fmt "\n", ##__VA_ARGS__)
 
+static void
+_fw_nft_append_cmd_table(NMStrBuf *strbuf, const char *family, const char *table_name, gboolean up)
+{
+    /* Either delete the table, or create/flush it. */
+    _append(strbuf, "add table %s %s", family, table_name);
+    _append(strbuf, "%s table %s %s", up ? "flush" : "delete", family, table_name);
+}
+
 static GBytes *
 _fw_nft_set_shared_construct(gboolean up, const char *ip_iface, in_addr_t addr, guint8 plen)
 {
@@ -621,8 +638,7 @@ _fw_nft_set_shared_construct(gboolean up, const char *ip_iface, in_addr_t addr,
 
     _share_iptables_subnet_to_str(str_subnet, addr, plen);
 
-    _append(&strbuf, "add table ip %s", table_name);
-    _append(&strbuf, "%s table ip %s", up ? "flush" : "delete", table_name);
+    _fw_nft_append_cmd_table(&strbuf, "ip", table_name, up);
 
     if (up) {
         _append(&strbuf,
diff --git a/src/libnm-glib-aux/nm-shared-utils.c b/src/libnm-glib-aux/nm-shared-utils.c
index 70db29f2b1..d5562233c7 100644
--- a/src/libnm-glib-aux/nm-shared-utils.c
+++ b/src/libnm-glib-aux/nm-shared-utils.c
@@ -6574,19 +6574,38 @@ nm_crypto_md5_hash(const guint8 *salt,
 
 /*****************************************************************************/
 
-char *
-nm_utils_get_process_exit_status_desc(int status)
+const char *
+nm_utils_get_process_exit_status_desc_buf(int status, char *buf, gsize buf_len)
 {
+    const char *buf0 = buf;
+
+    nm_assert(buf_len == 0 || buf);
+
+    /* This should give a partial sentence, it it can be combined with
+     * prinft("command XYZ %s.\n", desc) */
+
     if (WIFEXITED(status))
-        return g_strdup_printf("exited with status %d", WEXITSTATUS(status));
+        nm_strbuf_append(&buf, &buf_len, "exited with status %d", WEXITSTATUS(status));
     else if (WIFSIGNALED(status))
-        return g_strdup_printf("killed by signal %d", WTERMSIG(status));
+        nm_strbuf_append(&buf, &buf_len, "killed by signal %d", WTERMSIG(status));
     else if (WIFSTOPPED(status))
-        return g_strdup_printf("stopped by signal %d", WSTOPSIG(status));
+        nm_strbuf_append(&buf, &buf_len, "stopped by signal %d", WSTOPSIG(status));
     else if (WIFCONTINUED(status))
-        return g_strdup("resumed by SIGCONT)");
+        nm_strbuf_append(&buf, &buf_len, "resumed by SIGCONT");
     else
-        return g_strdup_printf("exited with unknown status 0x%x", status);
+        nm_strbuf_append(&buf, &buf_len, "exited with unknown status 0x%x", status);
+
+    return buf0;
+}
+
+char *
+nm_utils_get_process_exit_status_desc(int status)
+{
+    char buf[NM_UTILS_GET_PROCESS_EXIT_STATUS_BUF_LEN];
+
+    nm_utils_get_process_exit_status_desc_buf(status, buf, sizeof(buf));
+
+    return g_strdup(buf);
 }
 
 /*****************************************************************************/
diff --git a/src/libnm-glib-aux/nm-shared-utils.h b/src/libnm-glib-aux/nm-shared-utils.h
index f17b16460b..eea84577fe 100644
--- a/src/libnm-glib-aux/nm-shared-utils.h
+++ b/src/libnm-glib-aux/nm-shared-utils.h
@@ -1292,6 +1292,8 @@ typedef enum {
     NM_UTILS_ERROR_INVALID_ARGUMENT,    /*< nick=InvalidArgument >*/
     NM_UTILS_ERROR_NOT_READY,           /*< nick=NotReady >*/
 
+    NM_UTILS_ERROR_COMMAND_FAILED, /*< nick=CommandFailed >*/
+
     NM_UTILS_ERROR_AMBIGUOUS, /*< nick=Ambiguous >*/
 
     /* the following codes have a special meaning and are exactly used for
@@ -3299,6 +3301,10 @@ void nm_crypto_md5_hash(const guint8 *salt,
 
 /*****************************************************************************/
 
+#define NM_UTILS_GET_PROCESS_EXIT_STATUS_BUF_LEN 41
+
+const char *nm_utils_get_process_exit_status_desc_buf(int status, char *buf, gsize buf_len);
+
 char *nm_utils_get_process_exit_status_desc(int status);
 
 gboolean nm_utils_validate_hostname(const char *hostname);