Bug 499425 - On page load, WPA2-EAP CA-certificate field replaced with invalid file:// URI, causing subsequent connection failure
Summary: On page load, WPA2-EAP CA-certificate field replaced with invalid file:// URI...
Status: CONFIRMED
Alias: None
Product: systemsettings
Classification: Applications
Component: kcm_networkmanagement (other bugs)
Version First Reported In: 6.2.91
Platform: Kubuntu Linux
: NOR normal
Target Milestone: ---
Assignee: Plasma Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-02-02 20:05 UTC by Thomas
Modified: 2025-04-08 13:38 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments
Working config on top. Autogenerated, broken config on the bottom (61.61 KB, image/png)
2025-02-02 20:05 UTC, Thomas
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas 2025-02-02 20:05:18 UTC
Created attachment 177907 [details]
Working config on top. Autogenerated, broken config on the bottom

SUMMARY

When loading the WiFi settings of a WPA2-EAP encrypted network that has the CA-certificate field populated, the plain certificate path is replaced with a file:// URI that ends in a whitespace. Saving again saves the file URI which then causes connection failures.

I.e. "/home/user/.config/cert.pem" is replaced with "file:///home/user/.config/cert.pem "

STEPS TO REPRODUCE
1. Have a working WPA2-EAP encrypted wireless network connection, with CA-certificate explicitly set to a filesystem path.
2. Open the connection in the network connections module, go to the encryption tab
3. Observe that the CA-cert field now contains a file:// URI that ends with a whitespace character.
4. Edit something and revert (hit a key, then backspace in any line edit), to enable the Save button
5. Save the connection
6. Try to connect to the network
7. Observe it failing.

OBSERVED RESULT

No connection possible while the file:// URI is present in the CA-cert field.
freeradius3 on the backend server says:
```
(128) eap: Peer sent packet with method EAP NAK (3)
(128) eap: Peer NAK'd indicating it is not willing to continue
```

EXPECTED RESULT

Keep the field exactly as-is, similar to the username, password, anonymous identity field.

In the broken state, removing both "file://" and the trailing whitespace, then saving reverts to a working configuration.

SOFTWARE/OS VERSIONS
Operating System: Kubuntu 24.10
KDE Plasma Version: 6.1.5
KDE Frameworks Version: 6.6.0
Qt Version: 6.6.2
Kernel Version: 6.11.0-14-generic (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 3700X 8-Core Processor
Memory: 62.7 GiB of RAM
Graphics Processor: NVIDIA GeForce GTX 1070/PCIe/SSE2

ADDITIONAL INFORMATION
Comment 1 Bug Janitor Service 2025-02-02 20:33:36 UTC
Thank you for the bug report!

However Plasma 6.1.5 is no longer eligible for support or maintenance from KDE; supported versions are 5.27. (LTS), and 6.2 (non-LTS) or newer. Please upgrade to a supported version as soon as your distribution makes it available to you. Plasma is a fast-moving project, and bugs in one version are often fixed in the next one.

If you need support for Plasma 6.1.5, please contact your distribution, who bears the responsibility of providing support for older releases that are no longer supported by KDE.

If you can reproduce the issue after upgrading to a supported version, feel free to re-open this bug report.
Comment 2 Thomas 2025-02-16 19:59:55 UTC
This still happens on 6.2.91. Confirmed by updating an installation to the current Kubuntu 25.04 beta that ships the said version.

Additional exprimentation: The culprit is the trailing whitespace. file:// URIs are fine, but the added whitespace character breaks the resolution, causing WiFi login to fail.
Comment 3 Daniel 2025-04-08 13:38:15 UTC
Can confirm that it still happens on 6.3.4. It is a particularly nasty bug because it causes WiFi authentication to fail with no proper error message being exposed to the user. I sometimes also observed "%00 " being appended to the file name, but I can't reproduce it, contrary to the single space problem in the bug description.

I reproduce it as follows:
1. Verify no space at end of CA path
2. Select other WiFi entry from the list.
3. Go back to original network and see a appended space at the end.

Until then, no real harm is done (since it isn't saved, and save button is still disabled). But if you really want to change anything and save it, the space is added and wifi connection will fail.