GNOME Bugzilla – Bug 757843
Adding a wifi AP connection with invalid PSK for WPA-PSK via d-bus should fail
Last modified: 2015-11-20 09:41:40 UTC
I've tried this on NM versions 1.0.2 and 1.0.6, with similar results. I am adding a wifi AP connection to NM which uses WPA-PSK and provides an invalid password (less than 8 chars). NM will hapily create this connection, though is should fail an give an appropriate reason. Once created, bringing up the connection will ask for a password, because the given password fails the valid password check. And the NM logs give no specific indication of why the password fails. However, after adding the connection and then restarting NM, I do get this warning message in the NM logs: '<warn> ifcfg-rh: loading "/ etc/sysconfig/network-scripts/ifcfg-wifi-ap" fails: Invalid WPA_PSK (passphrases must be between 8 and 63 characters long (inclusive))' It would be nice to have that warning sent back as an error message in a failure response to the connection add with an invalid WPA password. I'm not sure if this is specific to the ifcfg-rh plugin, which I'm using, or specific to wifi AP mode (as opposed to other modes). Here is a python dictionary representation of the connection that is causing the bug: { 'connection': {'id': 'wifi-ap', 'type': '802-11-wireless', 'uuid': '<uuid>', 'gateway-ping-timeout': 0}, '802-11-wireless': {'mode': 'ap', 'security': '802-11-wireless-security', 'ssid': 'eenbridge10000'}, '802-11-wireless-security': {'key-mgmt': 'wpa-psk', 'psk': '10000'}, 'ipv4': {'method': 'manual', 'never-default': True, 'addresses': [['10.137.0.1', '16', '0.0.0.0']], }, 'ipv6': {'method': 'ignore'}, }
This is a regression caused by http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=dbbedce21f0dbb2849ed48bd2cee3b98e1ad2135 Related bug 745890.
A fix is available in jk/con-add-verify-secrets-bgo757843.
> libnm: add nm_setting_verify_secrets() and nm_connection_verify_secrets() Need Since: 1.2 and AVAILABLE_IN annotations. Maybe add a simple "string" secret verify helper and use that everywhere? Most of the secrets are just strings. Probably could have just: gboolean _nm_setting_verify_secret_string(const char *string, const char *setting_name, const char *property, GError **error); Otherwise LGTM.
(In reply to Dan Williams from comment #3) > > libnm: add nm_setting_verify_secrets() and nm_connection_verify_secrets() > > Need Since: 1.2 and AVAILABLE_IN annotations. > Fixed. > Maybe add a simple "string" secret verify helper and use that everywhere? > Most of the secrets are just strings. Probably could have just: > > gboolean _nm_setting_verify_secret_string(const char *string, const char > *setting_name, const char *property, GError **error); > Added the helper and also _verify_wep_key() helper in nm-setting-wireless-security.c Re-pushed.
Committed to master as 0f6baee core: verify secrets when adding connection via D-Bus (bgo #757843) b41b32c libnm: add nm_setting_verify_secrets() and nm_connection_verify_secrets()