Bug 518355 - NetworkManager-pptp disregards security option
Summary: NetworkManager-pptp disregards security option
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: NetworkManager-pptp
Version: 11
Hardware: i586
OS: Linux
low
high
Target Milestone: ---
Assignee: Dan Williams
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 544691 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-08-20 02:41 UTC by william hanlon
Modified: 2009-12-25 00:08 UTC (History)
2 users (show)

Fixed In Version: 0.7.2-1.fc11
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-12-24 20:44:01 UTC


Attachments (Terms of Use)
log of vpn connection failure and one route that gets set. (3.78 KB, text/plain)
2009-08-20 02:41 UTC, william hanlon
no flags Details
log of vpn connection success, routes added, and ppp device created (2.47 KB, text/plain)
2009-08-20 02:43 UTC, william hanlon
no flags Details
ppp peers file used for successful connection. (167 bytes, text/plain)
2009-08-20 02:45 UTC, william hanlon
no flags Details
/var/log/messages (3.12 KB, text/plain)
2009-12-10 05:48 UTC, Arthur Pemberton
no flags Details


Links
System ID Priority Status Summary Last Updated
Launchpad 371402 None None None Never
GNOME Bugzilla 596762 None None None Never

Description william hanlon 2009-08-20 02:41:54 UTC
Created attachment 358023 [details]
log of vpn connection failure and one route that gets set.

Description of problem:
NetworkManager-pptp-0.7.0.99-1.fc11.i586 will not connect my VPN I believe because it is not disabling 40-bit MPPE. Instructions for my VPN specifically state that 40-bit MPPE must be disabled. The pptp plugin edit options allow the following options for security: All Available (default), 128-bit, and 40 bit. I set it to 128-bit, but when I try to connect, I see in the log files that it doesn't seem to disable 40-bit. If I try to connect manually by calling pppd on the command line and setting the require-mppe-128 option, I can connect fine.

Version-Release number of selected component (if applicable):
NetworkManager-pptp-0.7.0.99-1.fc11.i586

How reproducible:
always

Steps to Reproduce:
1. Set security to 128-bit
2. activate vpn connection
  
Actual results:
Authentication seems to work OK, but the connection can not complete.


Expected results:
Connection completes, ppp device is assigned and IP address, routes are set and communications with VPN are established.

Additional info:
I'll include log files of connection failure with NetworkManager, connection success with manual call of pppd, and /etc/ppp/peers/uiuc file.

Comment 1 william hanlon 2009-08-20 02:43:31 UTC
Created attachment 358024 [details]
log of vpn connection success, routes added, and ppp device created

Comment 2 william hanlon 2009-08-20 02:45:00 UTC
Created attachment 358025 [details]
ppp peers file used for successful connection.

I connect manually using "sudo pppd call uiuc"

Comment 3 william hanlon 2009-09-26 03:40:04 UTC
I found a solution to this problem:

Using gconf-editor edit the VPN connection under system->Networking->connections, unset the "require-mppe" key, add a new key "require-mppe-128", type string, value "yes".

VPN works fine after that. This prevents the 40-bit key from being attempted for VPNs which require only the 128-bit key.

Comment 4 Dan Williams 2009-11-07 03:28:24 UTC
I believe this is fixed upstream by:

418b3c8f953e516df049c4c764e3467c0a19512a (master)
0c39c37fe4a395529bb7025027f60931152fd6ac (master)
5661093ca9a58f373a2e432871a7322352a2bdeb (0.7.x)
814bccb6d7d103b1e0ec3338c3140cb43a39b91d (0.7.x)

It's also bugzilla.gnome.org #596762 for the first one, and lp:371402 for the second.

Comment 5 Dan Williams 2009-11-07 03:29:18 UTC
I'll be posting F11 updates soon for all the VPN plugins.

Comment 6 Dan Williams 2009-11-23 22:35:29 UTC
Tagged and ready to build when NM 0.7.2 hits f11-updates.

Comment 7 Dan Williams 2009-12-07 08:05:37 UTC
*** Bug 544691 has been marked as a duplicate of this bug. ***

Comment 8 Fedora Update System 2009-12-07 18:49:19 UTC
NetworkManager-openconnect-0.7.2-1.fc11,NetworkManager-pptp-0.7.2-1.fc11,NetworkManager-openvpn-0.7.2-1.fc11,NetworkManager-vpnc-0.7.2-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/NetworkManager-openconnect-0.7.2-1.fc11,NetworkManager-pptp-0.7.2-1.fc11,NetworkManager-openvpn-0.7.2-1.fc11,NetworkManager-vpnc-0.7.2-1.fc11

Comment 9 Fedora Update System 2009-12-10 04:30:14 UTC
NetworkManager-openconnect-0.7.2-1.fc11, NetworkManager-pptp-0.7.2-1.fc11, NetworkManager-openvpn-0.7.2-1.fc11, NetworkManager-vpnc-0.7.2-1.fc11 has been pushed to the Fedora 11 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update NetworkManager-openconnect NetworkManager-pptp NetworkManager-openvpn NetworkManager-vpnc'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F11/FEDORA-2009-13032

Comment 10 Arthur Pemberton 2009-12-10 05:48:58 UTC
Created attachment 377382 [details]
/var/log/messages

I don't know if this problem has morphed, but I seem to be having a segfaulting pptp such as:

https://bugzilla.redhat.com/show_bug.cgi?id=504131
https://bugs.launchpad.net/ubuntu/+source/network-manager-pptp/+bug/314121
https://bugs.launchpad.net/ubuntu/+source/network-manager-pptp/+bug/356978

This is with:
kernel-2.6.30.9-102.fc11.x86_64
NetworkManager-0.7.2-1.fc11.x86_64
NetworkManager-pptp-0.7.2-1.fc11.x86_64

Side note : Selecting anything other than "All Available (Default)" Security results in "Use Point-to-Point encryption (MPPE)" being disabled.

Comment 11 Fedora Update System 2009-12-24 20:43:34 UTC
NetworkManager-openconnect-0.7.2-1.fc11, NetworkManager-pptp-0.7.2-1.fc11, NetworkManager-openvpn-0.7.2-1.fc11, NetworkManager-vpnc-0.7.2-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Arthur Pemberton 2009-12-25 00:08:02 UTC
Do I need to open my own bug report? Because this fix did not fix my pptp VPN


Note You need to log in before you can comment on or make changes to this bug.