Bug 498209

Summary:	Network widget shows protected wifi connections as unprotected
Product:	[Plasma] plasmashell	Reporter:	Erik Quaeghebeur <bugs.kde.org>
Component:	Networks widget	Assignee:	Plasma Bugs List <plasma-bugs-null>
Status:	RESOLVED DUPLICATE
Severity:	normal	CC:	justin, nate
Priority:	NOR
Version First Reported In:	6.2.4
Target Milestone:	1.0
Platform:	Other
OS:	Linux
Latest Commit:		Version Fixed/Implemented In:
Sentry Crash Report:

Description Erik Quaeghebeur 2025-01-03 15:21:58 UTC

SUMMARY
I am using iwd as the NetworkManager wifi backend. I have noticed that for many wifi connections, but not all, if they are protected (WPA2 Personal or Enterprise), the network widget shows them as unprotected. So once connected there is no lock icon overlay over the wifi rays icon. Also, when looking at the connection's details in the applet, for ‘security’ (‘beveiliging’ in Dutch, could also be something else in English, like ‘protection’) it says ‘unprotected’ (‘Onveilig’ in Dutch, could also be ‘unsafe’ or so). I've checked with `iwctl station wlan0 show` that there actually is protection (ATM, ‘Security: WPA2-Personal + FT’ for example).

STEPS TO REPRODUCE
1. Use iwd as NetworkManager wifi backend (perhaps it also occurs with other backends?)
2. Look at/connect with wifi SSID that you know is protected

OBSERVED RESULT
The applet indicates that it is unprotected

EXPECTED RESULT
The applet indicates that the correct protection

SOFTWARE/OS VERSIONS
iwd: 2.22
NetworkManager: 1.48.10
KDE Plasma Version: 6.2.4
KDE Frameworks Version: 6.7.0
Qt Version: 6.8.1

Comment 1 Nate Graham 2025-01-03 18:09:24 UTC

Cannot reproduce using the standard wpa_supplicant backend.

Can you see if the networkmanager command line shows the same issues? If so, this is a bug in NetworkManager or its iwd backend.

Comment 2 Erik Quaeghebeur 2025-01-03 21:09:16 UTC

(In reply to Nate Graham from comment #1)
> Can you see if the networkmanager command line shows the same issues? If so,
> this is a bug in NetworkManager or its iwd backend.

Well, networkmanager seems aware that wpa is used (‘geen’ is Dutch for ‘none’):

$ nmcli connection show <connection name>
…
802-11-wireless-security.key-mgmt:      wpa-psk
802-11-wireless-security.wep-tx-keyidx: 0
802-11-wireless-security.auth-alg:      --
802-11-wireless-security.proto:         --
802-11-wireless-security.pairwise:      --
802-11-wireless-security.group:         --
802-11-wireless-security.pmf:           0 (default)
802-11-wireless-security.leap-username: --
802-11-wireless-security.wep-key0:      <hidden>
802-11-wireless-security.wep-key1:      <hidden>
802-11-wireless-security.wep-key2:      <hidden>
802-11-wireless-security.wep-key3:      <hidden>
802-11-wireless-security.wep-key-flags: 0 (geen)
802-11-wireless-security.wep-key-type:  unknown
802-11-wireless-security.psk:           <hidden>
802-11-wireless-security.psk-flags:     0 (geen)
802-11-wireless-security.leap-password: <hidden>
802-11-wireless-security.leap-password-flags:0 (geen)
802-11-wireless-security.wps-method:    0x0 (default)
802-11-wireless-security.fils:          0 (default)
…

Comment 3 Justin Zobel 2025-01-04 02:13:13 UTC

Mine shows agent-owned (which I assume means password agent) meaning it has security.

nmcli connection show 'MySSID'
802-11-wireless-security.psk-flags:     1 (agent-owned)
802-11-wireless-security.leap-password: <hidden>
802-11-wireless-security.leap-password-flags:1 (agent-owned)

Comment 4 Erik Quaeghebeur 2025-01-04 11:09:03 UTC

(In reply to Justin Zobel from comment #3)
> Mine shows agent-owned (which I assume means password agent) meaning it has
> security.
> 
> nmcli connection show 'MySSID'
> 802-11-wireless-security.psk-flags:     1 (agent-owned)
> 802-11-wireless-security.leap-password: <hidden>
> 802-11-wireless-security.leap-password-flags:1 (agent-owned)

Looking at the NetworkManager documentation <https://networkmanager.dev/docs/api/latest/settings-802-11-wireless-security.html>, for there to be security,  802-11-wireless-security.key-mgmt must have an appropriate value, like wpa-psk (WPA Personal) for me, or perhaps ieee8021x (Dynamic WEP) as you likely have, given your use of a legacy leap password.

After a search in <https://invent.kde.org/plasma/plasma-nm> and <https://invent.kde.org/frameworks/networkmanager-qt> I have not found out whether and then where and how plasma-nm uses key-mgmt in the source code.

Comment 5 Nate Graham 2025-06-12 19:02:53 UTC


*** This bug has been marked as a duplicate of bug 491678 ***