Bug 2030997

Summary: Drop WEP support in NetworkManager and tools such as network-manager-applet, nmcli, nmtui, libnm
Product: Red Hat Enterprise Linux 9 Reporter: Vladimir Benes <vbenes>
Component: NetworkManagerAssignee: Lubomir Rintel <lrintel>
Status: CLOSED ERRATA QA Contact: Filip Pokryvka <fpokryvk>
Severity: unspecified Docs Contact: Marc Muehlfeld <mmuehlfe>
Priority: unspecified    
Version: 9.0CC: acabral, bgalvani, dcaratti, ferferna, fge, fpokryvk, jwboyer, lrintel, rkhan, rvr, sukulkar, till, vbenes
Target Milestone: rcKeywords: Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: NetworkManager-1.37.3-1.el9, libnma-1.8.40-1.el9 Doc Type: Enhancement
Doc Text:
.NetworkManager now clearly indicates that WEP support is not available in RHEL 9 The `wpa_supplicant` packages in RHEL 9.0 and later no longer contain the deprecated and insecure Wired Equivalent Privacy (WEP) security algorithm. This enhancement updates NetworkManager to reflect these changes. For example, the `nmcli device wifi list` command now returns WEP access points at the end of the list in gray color, and connecting to a WEP-protected network returns a meaningful error message. For secure encryption, use only wifi networks with Wi-Fi Protected Access 2 (WPA2) and WPA3 authentication.
Story Points: ---
Clone Of: 2029341 Environment:
Last Closed: 2022-11-15 10:49:31 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2029341    
Bug Blocks: 2030994, 2030996    
Deadline: 2022-08-22   

Description Vladimir Benes 2021-12-10 08:54:55 UTC
As we dropped WEP support in wpa_supplicant we need to remove it from nm-applet too.


+++ This bug was initially created as a clone of Bug #2029341 +++

Description of problem:
Drop WEP support in RHEL9, it is old and insecure.

Folow-up of this:
https://bugzilla.redhat.com/show_bug.cgi?id=2029338

Comment 1 Till Maas 2022-02-22 12:22:09 UTC
Current proposal:

- Given a RHEL 9 system with a WEP profile,
  when it is being activated
  then NM will log an via systemd stating that WEP is not supported anymore.
- Given a RHEL 9 system with a WEP profile,
  when it is activated via libnm/a tool like nmcli,
  then the activation will fail with a error message  stating that WEP is not supported anymore.
- Given a RHEL 9 system,
  when a user tries use nmcli or nm-applet or nm-connection editor to create a profile or change a profile to use WEP
  then there is no possibility to do this.
- Given a RHEL 9 system  with a profile using WEP
  when a user looks at it through nmcli or nm-applet
  then the profile is visible and it is visible that the profile is not supported anymore due to lack of WEP support.

Comment 4 Ana Cabral 2022-03-24 17:55:10 UTC
This was included in network-manager-applet builds:

* network-manager-applet-1.26.0-1.el8, for RHEL 8.7

* network-manager-applet-1.26.0-1.el9, for RHEL 9.1

Comment 13 Vladimir Benes 2022-04-25 09:14:26 UTC
moving to ITM12 as we don't have libnma patches ready.

Comment 14 Filip Pokryvka 2022-05-20 18:48:42 UTC
Hi Lubo,

as we discussed, libnma "Connect hiden Wi-Fi" (used in gnome-control-center and nm-applet) still shows WEP options for new connections, which should be fixed. Should I mark this failedQA and ASSIGNED, or is this comment enough? Moving ITM to 14, so there is a time to land the fix.

Comment 23 Filip Pokryvka 2022-07-14 08:10:18 UTC
We should have this covered in CI, moving to ITM 24, because of planned PTO.

Comment 24 Filip Pokryvka 2022-08-16 10:03:48 UTC
I see WEP is not recognized by nmcli, but it is still possible to modify connection to WEP via nmtui (and nmcli will not report it as WEP connection, but key-mgmt: none). Is it intention to keep at least one way (nmtui) if someone really needs WEP? But I think wpa_supplicant is build without WEP support on RHEL9, so it makes little sense (building wpa_supp from sources would be required).

Comment 28 Filip Pokryvka 2022-09-01 06:13:23 UTC
There is upstream fix for nmtui as well, verifying.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1340

Comment 31 errata-xmlrpc 2022-11-15 10:49:31 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (NetworkManager bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8265