Bug 191120 - add LEAP authentication support
Summary: add LEAP authentication support
Status: RESOLVED FIXED
Alias: None
Product: Network Management
Classification: Unmaintained
Component: KDED Module (show other bugs)
Version: 0.7
Platform: Ubuntu Linux
: NOR wishlist
Target Milestone: ---
Assignee: Will Stephenson
URL:
Keywords:
: 158248 (view as bug list)
Depends on:
Blocks:
 
Reported: 2009-04-30 09:36 UTC by Ed Guenthner
Modified: 2009-09-08 15:47 UTC (History)
5 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
Log file + qdbus runs (19.61 KB, application/octet-stream)
2009-08-17 13:10 UTC, Ed Guenthner
Details
qdbus output under plasma-widget-networkmanager (427 bytes, text/plain)
2009-08-17 16:37 UTC, Charlie Figura
Details
/var/log/daemon.log output under plasma-widget-networkmanager (5.51 KB, text/plain)
2009-08-17 16:38 UTC, Charlie Figura
Details
qdbus output under nm-applet (473 bytes, text/plain)
2009-08-17 16:39 UTC, Charlie Figura
Details
/var/log/daemon.log output under nm-applet (10.66 KB, text/plain)
2009-08-17 16:40 UTC, Charlie Figura
Details
extract from /var/log/syslog for failing connect with applet (22.07 KB, text/plain)
2009-08-21 09:08 UTC, Ed Guenthner
Details
qdbusform output for applet (310 bytes, text/plain)
2009-08-21 09:08 UTC, Ed Guenthner
Details
extract from syslog: leap with nm-applet passing (14.13 KB, text/plain)
2009-08-21 09:13 UTC, Ed Guenthner
Details
qdbusform for nm-applet (439 bytes, text/plain)
2009-08-21 09:14 UTC, Ed Guenthner
Details
/var/log/daemon.log output under plasma-widget-networkmanager 0.1~svn1017841-0ubuntu2~jaunty3 (4.81 KB, text/plain)
2009-09-04 19:57 UTC, Charlie Figura
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Ed Guenthner 2009-04-30 09:36:55 UTC
Version:            (using KDE 4.2.0)
OS:                Linux
Installed from:    Ubuntu Packages

Looks like there is no way to use LEAP authentication with kubuntu jaunty.
Not much else to say.
Comment 1 Jonas 2009-07-24 02:04:20 UTC
looks there is no way for NetworkManager-kde4, the kde3 version works
Comment 2 Ed Guenthner 2009-07-24 08:35:28 UTC
Please be more specific.

Does your answer mean: "this is a known deficiency; 
and for certain reasons it will not be fixed!" ???

If so - what are the reasons behind this decision?

You see, as crappy LEAP is - it is still used within 
a lot of corporations, like IBM for example. 
And that wont change in the near future.

Are you saying that all the people who want to use
LEAP with linux + kde ... will have to live with 
the fact that the "standard" tool simply refuses to
work with LEAP?
Comment 3 Jonas 2009-07-24 10:10:48 UTC
I am one of the people who would like to use LEAP.
But I do not know anything about what the developers think about it. It was only a statement of mine that it works in prior kde3. So it is no problem with NetworkManager but only a problem of the front end. I would also appreciate if the front end for kde4 supports LEAP.
Comment 4 Will Stephenson 2009-07-24 13:44:06 UTC
@edgue@web.de:

LEAP support is possible, but I haven't planned when to do it yet.  I'll update this bug when I do plan to work on it.  In the meantime, patches will be accepted.
Comment 5 Ed Guenthner 2009-07-24 14:28:20 UTC
Thanks for the update. 

I will keep my fingers crossed that you find the time to 
plan for this feature some day ;-)
Comment 6 Will Stephenson 2009-08-04 09:21:33 UTC
*** Bug 158248 has been marked as a duplicate of this bug. ***
Comment 7 Will Stephenson 2009-08-06 13:51:09 UTC
SVN commit 1007877 by wstephens:

LEAP support - in theory.  I have no way to test this, feedback
appreciated.

If it does not work, please give comparative debug output between this
and nm-applet as described here:
http://userbase.kde.org/NetworkManagement#It.27s_All_KDE.27s_Fault.21

BUG:191120


 M  +3 -0      CMakeLists.txt  
 A             security/eapmethodleap.cpp   [License: LGPL]
 A             security/eapmethodleap.h   [License: LGPL]
 M  +11 -3     security/wpaeapwidget.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1007877
Comment 8 Ed Guenthner 2009-08-06 15:57:38 UTC
Woha, that was fast. Thank you very much!

My problem: I never verified any pfix KDE component. 

I assume one way would be to upgrade my kubuntu 9.04 ... 
to some daily KDE build? (I am somewhat hesitant to 
do that on my production machine).

[ Well, i will ask around if one of my more-into-such-things
coworkers is willing to ... ]

another option for me would be: someone sending me
a detailed description what I need to do ... or for example
this fix compiled for the kubuntu 9.04 level ... so I can
update the corresponding component only.
Comment 9 Ed Guenthner 2009-08-14 16:00:00 UTC
Installed kubuntu 9.10 alpha 4 and compiled the private fix.
Doesnt work for me. 

Do I need to reopen this ticket; or more debug work first?
Comment 10 Will Stephenson 2009-08-14 19:27:35 UTC
See http://userbase.kde.org/NetworkManagement

NM logs and dbus connection compared with nm-applet, please
Comment 11 Will Stephenson 2009-08-16 20:58:00 UTC
I fixed a bug that caused the LEAP auth method to not be saved or restored correctly.  This was committed as r1011990. 

Although I don't have any EAP-LEAP network to test against, i have set up a dummy EAP-LEAP connection which looks kosher compared to nm-applet (I will remove the spurious system-ca-certs key shortly).

a{sa{sv}}(==802-11-wireless==
mode: infrastructure
security: 802-11-wireless-security
ssid: leapnet
==802-11-wireless-security==
key-mgmt: wpa-eap
==802-1x==
eap: leap
identity: someleapuser
system-ca-certs: true
==connection==
autoconnect: false
id: EAP Leap Test KNM
type: 802-11-wireless
uuid: 8bfa79e0-2504-4dda-b6a3-48ffced1fafe
)

[ nm-applet EAP-LEAP]
a{sa{sv}(==802-11wireless==
mode: infrastructure
security: 802-11-wireless-security
ssid: leapo              
==802-11-wireless-security==  
key-mgmt: wpa-eap
==802-1x==   
eap:leap                   
identity: someleapuser                                                                         
==connection==                                                                  
id: EAP Leap Test       
type: 802-11-wireless
uuid: 5a96a571-0710-4a2b-8eec-1867f27dfb06
==ipv4==                                                          
addresses: aau()         
dns: au()               
method: auto            
routes: aau()            
)                    

However I just realised that nm-applet offers both 'simple' (for want of a better word) LEAP and WPA-EAP with LEAP as an auth method, and I have only implemented the latter type.

If you have LEAP selected directly in the first Wireless Security combo in nm-applet (or a working nm-applet connection looks like this, note the presence of leap-username), you will have to wait a bit longer for me to implement 'simple' LEAP'


[ nm-applet simple LEAP ]
a{sa{sv}}(==802-11-wireless==
mode: infrastructure
security: 802-11-wireless-security
ssid: leapo
==802-11-wireless-security==
auth-alg: leap
key-mgmt: ieee8021x
leap-username: someleapuser
==connection==
id: Leap Test
type: 802-11-wireless
uuid: 0bbfbdca-78b8-4f86-b2ba-dd3eec198def
==ipv4==
addresses: aau()
dns: au()
method: auto
routes: aau()
)

If possible, please test and tell me if it now works.
Comment 12 Will Stephenson 2009-08-16 21:11:03 UTC
r1012083 is needed before you try the test suggested in the previous comment.
Comment 13 Will Stephenson 2009-08-16 21:50:04 UTC
SVN commit 1012102 by wstephens:

Restore EAP-LEAP usernames and passwords correctly in the editor.
CCBUG: 191120


 M  +3 -8      eapmethodleap.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1012102
Comment 14 Will Stephenson 2009-08-16 21:54:13 UTC
SVN commit 1012107 by wstephens:

Add 'simple' LEAP support.

Untested but looks equivalent to simple LEAP connections created by
nm-applet.  Please test.

CCBUG: 191120


 M  +2 -0      CMakeLists.txt  
 A             security/leap.ui   security/eapmethodsimplebase.ui#1011983
 A             security/securityleap.cpp   [License: GPL (v2/3)]
 A             security/securityleap.h   [License: GPL (v2/3)]
 M  +17 -2     security/wirelesssecuritysettingwidget.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1012107
Comment 15 Ed Guenthner 2009-08-17 13:10:17 UTC
Created attachment 36214 [details]
Log file + qdbus runs
Comment 16 Will Stephenson 2009-08-17 13:36:38 UTC
These aren't equivalent connections - the nm-applet connection is a LEAP network with essid 'IBM' and the knm connection is a WEP network  with essid 'gawe4'.

Also there doesn't seem to be a full connection attempt using either connection in the syslog, and if there were, it's hard for me to figure out which is which, if they are both in one file.

I suggest you save the syslog on each connection attempt, filter out the NetworkManager stuff with 

  grep NetworkManager your-syslog-copy > some-connection-attempt.log

and trim the logfile so it only contains the log for that particular connection attempt - use the timestamps at the beginning of each line.

https://bugzilla.novell.com/show_bug.cgi?id=525980#c17 is an example of a comprehensive and relevant log.
Comment 17 Will Stephenson 2009-08-17 13:45:33 UTC
Also since you are compiling KNM yourself, do me a favour and use tests/qdbusfornm instead of plain qdbus to get all the connection settings off the bus - its output formatted clearly.
Comment 18 Charlie Figura 2009-08-17 16:35:01 UTC
Okay, here's the test results I just ran (sorry that it took a week to get to this).  I'm running up-to-date kubuntu jaunty.
network-manager-gnome: 0.7.1~rc4.1-0ubuntu2
plasma-widget-network-manager: 0.1~svn1002781-0ubuntu2~jaunty1~ppa1

I've attached qdbus output as directed as well as output from /var/log/daemon.log.
I'm not sure how to format the qdbus output
Comment 19 Charlie Figura 2009-08-17 16:37:08 UTC
Created attachment 36221 [details]
qdbus output under plasma-widget-networkmanager
Comment 20 Charlie Figura 2009-08-17 16:38:29 UTC
Created attachment 36222 [details]
/var/log/daemon.log output under plasma-widget-networkmanager
Comment 21 Charlie Figura 2009-08-17 16:39:21 UTC
Created attachment 36223 [details]
qdbus output under nm-applet
Comment 22 Charlie Figura 2009-08-17 16:40:33 UTC
Created attachment 36224 [details]
/var/log/daemon.log output under nm-applet
Comment 23 Will Stephenson 2009-08-17 16:50:23 UTC
Charles, 

I'm really sorry to have to point this out after you have done all this troubleshooting for me, but r1002781 is from 27 Jul, 3 weeks ago, and all the LEAP work has happened in the last week.

CCing John from kubuntu - here's another place we need to know where the up to date packages are.
Comment 24 Ed Guenthner 2009-08-17 17:11:00 UTC
Sorry for providing the wrong debug content for the kde applet

I will try again tomorrow ...
Comment 25 Ed Guenthner 2009-08-21 09:08:09 UTC
Created attachment 36321 [details]
extract from /var/log/syslog for failing connect with applet
Comment 26 Ed Guenthner 2009-08-21 09:08:56 UTC
Created attachment 36322 [details]
qdbusform output for applet
Comment 27 Ed Guenthner 2009-08-21 09:13:40 UTC
Created attachment 36323 [details]
extract from syslog: leap with nm-applet passing
Comment 28 Ed Guenthner 2009-08-21 09:14:31 UTC
Created attachment 36324 [details]
qdbusform for nm-applet
Comment 29 Ed Guenthner 2009-08-21 09:15:26 UTC
Sorry for the delay ... but I hope now you have got all you need for the moment.
Comment 30 Will Stephenson 2009-08-24 13:30:16 UTC
Ed:

There are 2 kinds of LEAP supported by both applets

Simple LEAP

802.1x LEAP (EAP-LEAP)

I haven't found a good reference for the difference between the two, but from observation, Simple Leap appears to be a kind of WEP using LEAP for auth, and EAP-LEAP is 802.1x using LEAP as the auth method.

In your info, the working nm-applet connection is EAP-LEAP (Security: WPA/WPA2 Enterprise, Authentication: LEAP) whereas the non-working knm connection is Simple LEAP.  (Security: LEAP).  You're not comparing like with like.

My guess is this is why it fails with knm, since I can create an EAP-LEAP connection that appears identical on the bus to one created with nm-applet.  Nm-applet also presents both types with very similar UI so I guess you created different types when troubleshooting by accident.

Can you remove the existing knm connection and recreate it by setting Security: WPA/WPA2 Enteprise and Authentication to LEAP?  Thanks again.
Comment 31 Charlie Figura 2009-08-24 13:54:43 UTC
Will -

Still no word on an ubuntu package for that latest knm revision, is there?
Thanks for sending me the info on compiling, but I had so many problems I had 
to abort.  I'm happy to test, but can't commit the time to figuring out the 
compiling issues I was having.

I know that my working nm-applet configuration uses 802.1x LEAP, so I'd like to 
be able to help test.

Thanks -

-Charlie

On Monday 24 August 2009 06:30:21 am Will Stephenson wrote:
> https://bugs.kde.org/show_bug.cgi?id=191120
>
>
>
>
>
> --- Comment #30 from Will Stephenson <wstephenson kde org>  2009-08-24
> 13:30:16 --- Ed:
>
> There are 2 kinds of LEAP supported by both applets
>
> Simple LEAP
>
> 802.1x LEAP (EAP-LEAP)
>
> I haven't found a good reference for the difference between the two, but
> from observation, Simple Leap appears to be a kind of WEP using LEAP for
> auth, and EAP-LEAP is 802.1x using LEAP as the auth method.
>
> In your info, the working nm-applet connection is EAP-LEAP (Security:
> WPA/WPA2 Enterprise, Authentication: LEAP) whereas the non-working knm
> connection is Simple LEAP.  (Security: LEAP).  You're not comparing like
> with like.
>
> My guess is this is why it fails with knm, since I can create an EAP-LEAP
> connection that appears identical on the bus to one created with nm-applet.
> Nm-applet also presents both types with very similar UI so I guess you
> created different types when troubleshooting by accident.
>
> Can you remove the existing knm connection and recreate it by setting
> Security: WPA/WPA2 Enteprise and Authentication to LEAP?  Thanks again.
Comment 32 Will Stephenson 2009-08-24 14:21:19 UTC
Charlie,

None I'm afraid

Will
Comment 33 Ed Guenthner 2009-08-24 17:04:37 UTC
I deleted the existing profile, and created a new one; following your instructions.

The fact that I am answering you right now means ... I am WPA LEAP WLAN connected,
using the new networkmanagement applet! 

Sir, thank you sir!

Can you officially release this now ... or is anything else missing?

[ offtopic: Charles asked how I got to the "compiling point" ... well, all one needs to know should be in here: http://kubuntuforums.net/forums/index.php?topic=3105763.0 ]
Comment 34 Will Stephenson 2009-08-24 18:02:05 UTC
That's excellent news; thank you for testing!

I have a number of other things to do such as fixing up mobile broadband and troubleshooting VPN connections before I do a 1.0 release - I expect Kubuntu, fedora and openSUSE's autumn releases will ship svn snapshots before then though.
Comment 35 Ed Guenthner 2009-08-25 08:56:33 UTC
Sorry, but I am not sure if I got that right.

You are saying that you need some more time; so I shouldnt expect that kubuntu 9.10 comes with your fix?

[ might be OK for me; now that I know how to build a leap-enabled version ;-) ]
Comment 36 Will Stephenson 2009-08-25 09:10:41 UTC
On Tuesday 25 August 2009 08:56:36 Ed Guenthner wrote:
> Sorry, but I am not sure if I got that right.
> 
> You are saying that you need some more time; so I shouldnt expect that
>  kubuntu 9.10 comes with your fix?

No, I'm saying that it will come with it irrespective of whether I 'do a 
release' or not.
Comment 37 Charlie Figura 2009-09-04 19:56:27 UTC
I don't know if the 'fixed' version is what was released on kubuntu this afternoon, but if it is, it's still not working for peap.  I just upgraded to the plasmoid-widget-network-manager version 0.1~svn1017841-0ubuntu2~jaunty3 package, and there's no joy.  /var/log/daemon.log output is attached.

And if this *isn't* the 'fixed' version, I'll sure be looking forward to seeing that come out here at some point!
Comment 38 Charlie Figura 2009-09-04 19:57:43 UTC
Created attachment 36693 [details]
/var/log/daemon.log output under plasma-widget-networkmanager 0.1~svn1017841-0ubuntu2~jaunty3
Comment 39 Will Stephenson 2009-09-07 16:27:38 UTC
Charlie: that version should be new enough.  But you said "not working for peap". Do you mean leap or peap?

if PEAP, attach qdbus output at 192597

if LEAP, attath it here.

Will
Comment 40 Charlie Figura 2009-09-08 15:47:42 UTC
Sorry, it should be PEAP, not LEAP.  I've attached the requested info under that bug.