Bug 1469852

Summary: Cannot configure WPA2 enterprise TLS
Product: [Fedora] Fedora Reporter: Brandon Bennett <bbennett>
Component: network-manager-appletAssignee: Beniamino Galvani <bgalvani>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 26CC: bgalvani, blueowl, danielsun3164, dcbw, jes.sorensen, leinardi, lkundrak, louisa.hartnett, michel, nick, thaller, todd_lewis, warlock.cc, wibrown
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: network-manager-applet-1.8.2-3.fc26 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-26 19:53:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
[PATCH] libnma: don't return empty passwords from certificate chooser none

Description Brandon Bennett 2017-07-12 01:14:52 UTC 
Description of problem:
When trying to setup WPA2 enterprise with TLS the dialog box asks for passwords for the CA, the client cert, and the client key.  Only my client key has a password on it and the boxes for the password for CA and cert are disabled.

If i try connecting i get the following error:


Jul 11 18:52:28 thecheat gnome-control-c[9984]: Failed to add new connection: (7) 802-1x.ca-cert-password: password is not supported when certificate is not on a PKCS#11 token


If i ignore the CA in the config it fails on the client-cert-password instead:

Jul 11 19:00:23 thecheat gnome-control-c[9984]: Failed to add new connection: (7) 802-1x.client-cert-password: password is not supported when certificate is not on a PKCS#11 token



Version-Release number of selected component (if applicable): 1.8.2


How reproducible: Everytime


Steps to Reproduce:
1. Create new wifi profile with WPA2 Enterprise. 
2. Select TLS
3. Use a CA (or skip) use a client certificate and client key (that is encrypted) and click connect

Actual results:

I get no error in the settings app.  In nm-connection-editor I get the error that shows up in the logs.  

Log error is :
Jul 11 18:52:28 thecheat gnome-control-c[9984]: Failed to add new connection: (7) 802-1x.ca-cert-password: password is not supported when certificate is not on a PKCS#11 token


Expected results:
It doesn't use an empty key for ca-cert or client-cert and instead just connect to wifi


Additional info:
Works on Fedora 25.  Dialog seems different
Comment 1 Jes Sorensen 2017-07-12 17:36:41 UTC 
Same problem here :(

Basically makes it impossible to connect to the network here.....
Comment 2 Brandon Bennett 2017-07-12 20:41:38 UTC 
Looks like this has been fixed upstream already.  

https://github.com/NetworkManager/NetworkManager/commit/699492c1a5509083aa87e770cc1df7de1a52f1ed#diff-d625f9505e195dbf49ba95c79cfadc5c
Comment 3 Michel Lind 2017-07-12 21:21:39 UTC 
(In reply to Brandon Bennett from comment #2)
> Looks like this has been fixed upstream already.  
> 
> https://github.com/NetworkManager/NetworkManager/commit/
> 699492c1a5509083aa87e770cc1df7de1a52f1ed#diff-
> d625f9505e195dbf49ba95c79cfadc5c

note: that fix is in the master branch and not in nm-1-8. 1.8.2 was actually cut after the fix was committed but does not contain the change.
Comment 4 Brandon Bennett 2017-07-12 23:03:01 UTC 
The offending commit isn't in 1.8 either so maybe that is the wrong patch.
Comment 5 Beniamino Galvani 2017-07-18 09:01:11 UTC 
Created attachment 1300327 [details]
[PATCH] libnma: don't return empty passwords from certificate chooser
Comment 6 Louisa Hartnett 2017-08-18 08:58:07 UTC 
Comment on attachment 1300327 [details]
[PATCH] libnma: don't return empty passwords from certificate chooser

I see the update regarding the patch, is there a timeline for this to be rolled out as a fix for this Network Manager issue?

Thanks and regards,
Louisa Hartnett
Comment 7 Rodolfo Granata 2017-08-22 01:49:41 UTC 
Having the same issue since upgrade to F26, is there any workaround in the meantime?
Comment 8 Nick Krichevsky 2017-08-22 19:30:29 UTC 
(In reply to Rodolfo Granata from comment #7)
> Having the same issue since upgrade to F26, is there any workaround in the
> meantime?

The workaround I found was to downgrade NetworkMangaer to the version in the Fedora 25 repositories using dnf install NetworkManager-1.4.4-5.fc25 --release=25 --allowerasing

Note that this does downgrade some packages such as python, but you can reinstall them manually (for instance I reinstalled python with  sudo dnf install python3-3.6.2-5.fc26 --release=26 --allowerasing).

Not sure if this is the greatest solution but it is a workaround that worked for me.
Comment 9 Thomas Haller 2017-08-23 11:39:53 UTC 
(In reply to Beniamino Galvani from comment #5)
> Created attachment 1300327 [details]
> [PATCH] libnma: don't return empty passwords from certificate chooser

lgtm. Applied upstream as https://git.gnome.org/browse/network-manager-applet/commit/?id=f78c1fe9e528a7cf2edd430a559e2fe5fd5525a7

(In reply to Rodolfo Granata from comment #7)
> Having the same issue since upgrade to F26, is there any workaround in the
> meantime?

use nmcli to fix the connection, something like
  nmcli connection modify "$CONN" 802-1x.ca-cert ''

(In reply to Nick Krichevsky from comment #8)
> (In reply to Rodolfo Granata from comment #7)
> > Having the same issue since upgrade to F26, is there any workaround in the
> > meantime?
> 
> The workaround I found was to downgrade NetworkMangaer to the version in the
> Fedora 25 repositories using dnf install NetworkManager-1.4.4-5.fc25
> --release=25 --allowerasing
> 
> Note that this does downgrade some packages such as python, but you can
> reinstall them manually (for instance I reinstalled python with  sudo dnf
> install python3-3.6.2-5.fc26 --release=26 --allowerasing).
> 
> Not sure if this is the greatest solution but it is a workaround that worked
> for me.

according to comment 5 is the issue in libnma, not NetworkManager package. You might also just downgrade libnma package alone (NetworkManager is backward compatible against older libnma versions, not the other way around).
Comment 10 Fedora Update System 2017-08-23 12:21:21 UTC 
network-manager-applet-1.8.2-3.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-73d143918a
Comment 11 Nick Krichevsky 2017-08-23 14:53:18 UTC 
(In reply to Thomas Haller from comment #9)
> (In reply to Beniamino Galvani from comment #5)
> > Created attachment 1300327 [details]
> > [PATCH] libnma: don't return empty passwords from certificate chooser
> 
> lgtm. Applied upstream as
> https://git.gnome.org/browse/network-manager-applet/commit/
> ?id=f78c1fe9e528a7cf2edd430a559e2fe5fd5525a7
> 
> (In reply to Rodolfo Granata from comment #7)
> > Having the same issue since upgrade to F26, is there any workaround in the
> > meantime?
> 
> use nmcli to fix the connection, something like
>   nmcli connection modify "$CONN" 802-1x.ca-cert ''
> 
> (In reply to Nick Krichevsky from comment #8)
> > (In reply to Rodolfo Granata from comment #7)
> > > Having the same issue since upgrade to F26, is there any workaround in the
> > > meantime?
> > 
> > The workaround I found was to downgrade NetworkMangaer to the version in the
> > Fedora 25 repositories using dnf install NetworkManager-1.4.4-5.fc25
> > --release=25 --allowerasing
> > 
> > Note that this does downgrade some packages such as python, but you can
> > reinstall them manually (for instance I reinstalled python with  sudo dnf
> > install python3-3.6.2-5.fc26 --release=26 --allowerasing).
> > 
> > Not sure if this is the greatest solution but it is a workaround that worked
> > for me.
> 
> according to comment 5 is the issue in libnma, not NetworkManager package.
> You might also just downgrade libnma package alone (NetworkManager is
> backward compatible against older libnma versions, not the other way around).

Just tried it - yes, this does work. dnf install libnma-1.40-1.fc25 --release=25 Thank you for the heads up.
Comment 12 Fedora Update System 2017-08-24 01:51:06 UTC 
network-manager-applet-1.8.2-3.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-73d143918a
Comment 13 Fedora Update System 2017-08-26 19:53:46 UTC 
network-manager-applet-1.8.2-3.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.