GNOME Bugzilla – Bug 705162
NM goes crazy after choosing certificate to use for VPN connection
Last modified: 2020-11-12 14:31:37 UTC
I start creating a VPN connection based on openvpn, and when it comes to select the User certificate, I choose it in the file-selector, and right-away NM UI gets stuck (no refresh, and becomes all greyish). it happens wether I use nm-connection-editor or the network item of control-center. Name : NetworkManager Arch : x86_64 Epoch : 1 Version : 0.9.8.2 Release : 8.git20130709.fc19 Stacktrace: [Thread 0x7fffe9de6700 (LWP 4392) exited] ** (nm-connection-editor:4365): WARNING **: Invalid setting VPN: remote ** (nm-connection-editor:4365): WARNING **: Invalid setting VPN: remote ** (nm-connection-editor:4365): WARNING **: Invalid setting VPN: remote ** (nm-connection-editor:4365): WARNING **: Invalid setting VPN: remote ** (nm-connection-editor:4365): WARNING **: Invalid setting VPN: remote ** (nm-connection-editor:4365): WARNING **: Invalid setting VPN: remote (nm-connection-editor:4365): Gtk-CRITICAL **: gtk_file_chooser_select_filename: assertion `filename != NULL' failed (nm-connection-editor:4365): Gtk-CRITICAL **: gtk_file_chooser_select_filename: assertion `filename != NULL' failed .... ** (nm-connection-editor:4365): WARNING **: Invalid setting VPN: remote ** (nm-connection-editor:4365): WARNING **: Invalid setting VPN: remote ^C Program received signal SIGINT, Interrupt. (gdb) thread apply all bt
+ Trace 232318
Thread 1 (Thread 0x7ffff7fc5a00 (LWP 4680))
There is a problem with decoding the certificate. Is the file correct/not corrupted? What type of the certificate is it? Does the certificate password contain any special characters? To debug further we would need more information. It would be good if you install NetworkManager-debuginfo and reproduce again so that we have a backtrace with more details. Do you happen to have a Big Endian machine (PowerPC)?
Is the file correct/not corrupted? - likely not, as I downloaded it on two different machines and tested on those two machines with the same result; however I'll try again. What type of the certificate is it? - PKCS#12 Does the certificate password contain any special characters? - no NetworkManager-debuginfo was IIRC installed because I did the backtrace twice, as the first time gdb suggest me to install this package, however I can try again. Do you happen to have a Big Endian machine (PowerPC)? - I don't have such machine.
I confirm the answers above.
Is there something I can do (new information, ...) to make this bug solved ?
(In reply to comment #4) > Is there something I can do (new information, ...) to make this bug solved ? send us the certificate file and password? :-) it really looks like an NSS bug though. Well... I guess you could interrupt it like above, and then see if SEC_PKCS12DecoderUpdate() ever returns. If it doesn't, then it's (probably) NSS's fault. If it does return, then continue and see if you end up in the same place again; if so, then there's some bug in NM that's causing it to reload the certificate over and over in an infinite loop for some reason.
I have the exact same issue too. I have had it for awhile, the workaround is that I use is to use the openvpn cli. ┌(linux-rocks)─(0)─(10:48 AM Fri May 09) └─(~)─(7 files, 588Kb)─> cat /etc/os-release NAME="Arch Linux" ID=arch PRETTY_NAME="Arch Linux" ANSI_COLOR="0;36" HOME_URL="https://www.archlinux.org/" SUPPORT_URL="https://bbs.archlinux.org/" BUG_REPORT_URL="https://bugs.archlinux.org/" ┌(linux-rocks)─(0)─(10:48 AM Fri May 09) └─(~)─(7 files, 588Kb)─> uname -r 3.14.2-1-ARCH ┌(linux-rocks)─(0)─(10:15 AM Fri May 09) └─(~)─(7 files, 588Kb)─> NetworkManager --version 0.9.8.10 Reference: https://bbs.archlinux.org/viewtopic.php?id=177811 Since the update to the latest NetworkManager the output has changed, note the forum post. May 09 10:52:58 linux-rocks gnome-control-center.desktop[4245]: (gnome-control-center:4245): network-cc-panel-WARNING **: Error connecting to ModemManager: Error calling StartServiceByName for org.freedesktop.ModemManager1: GDBus.Error:org.freedesktop.systemd1.LoadFailed: Unit dbus-org.freedesktop.ModemManager1.service failed to load: No such file or directory. May 09 10:53:28 linux-rocks gnome-session[736]: Window manager warning: last_focus_time (9243686) is greater than comparison timestamp (9243685). This most likely represents a buggy client sending inaccurate timestamps in messages such as _NET_ACTIVE_WINDOW. Trying to work around... I have two different VPN cert one is a new one and the other is a few years old and I know that it works in OpenSuSE and Fedora. I have not tried the new cert in other distributions but it does work if I use the OpenVPN cli.
Okay, I figured out the issue. For what ever reason the NetworkManager did not like the cert but I was able to us the openvpn cli just fine with it. I am using the OpenVPN server packaged with Pfsense and when I download the certs through the web interface and use them in NetworkManager editor it acts all buggy. But if I scp the cert from the Pfsense system it all works great!
Created attachment 286503 [details] [review] patch for properties/auth_helpers.c
The problem is not related to the certificate, but it is simply how the dialog UI manages fields "user", "cert", "key" to be sure that either all of them contain the same pkcs12 file path or none of them contain it. This is implemented with event handlers triggered when field selections change. Unfortunately this handlers are triggered in such a way that an endless loop occurs. The affected library is /usr/lib/NetworkManager/libnm-openvpn-properties.so of package NetworkManager-openvpn-0.9.8.2 A patch is attached for the source properties/auth-helpers.c
bugzilla.gnome.org is being shut down in favor of a GitLab instance. We are closing all old bug reports and feature requests in GNOME Bugzilla which have not seen updates for a long time. If you still use NetworkManager and if you still see this bug / want this feature in a recent and supported version of NetworkManager, then please feel free to report it at https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/ Thank you for creating this report and we are sorry it could not be implemented (workforce and time is unfortunately limited).