netplan NM plugin generates broken connection for WPA-Enterprise PEAP

[Tony Espy]

When a WPA Enterprise PEAP connection is configured with the network-manager snap, the resulting netplan connection file generated doesn't include "auth.method", instead '802-1x.eap: "peap"' is included in "passthrough" stanza.

"mywifi":
  auth:
    key-management: "eap"
    identity: "myid"
    phase2-auth: "mschapv2"
    password: "mypassword"
  networkmanager:
    name: "mywifi"
    passthrough:
      wifi-security.auth-alg: "open"
      802-1x.eap: "peap;"

This results in a NM keyfile being generated with an incomplete [802-1x] stanza:

[wifi-security]
auth-alg=open
key-mgmt=wpa-eap

[802-1x]
eap=peap

This is logged by the NM settings plugin:

Nov 20 10:57:05 brain NetworkManager[6358]: <error> [1700495825.5266] BUG: the profile cannot be stored in keyfile format without becoming unusable: invalid connection: 802-1x.identity
: property is missing

Steps to reproduce:

1. Install network-manager snap (I used 22/stable) on a Desktop system (for consistency I used 22.04 LTS)
2. Stop NetworkManager service (sudo systemctl stop NetworkManager.service)
3. Start NM from the snap (sudo snap start network-manager.networkmanager)
4. Create connection:

network-manager.nmcli con add type wifi con-name "mywifi" ifname "wlp4s0" ssid "mywifi" wifi-sec.auth-alg open wifi-sec.key-mgmt wpa-eap 802-1x.eap peap 802-1x.identity "myid" 802-1x.password "mypassword" 802-1x.phase2-auth mschapv2 802-1x.system-ca-certs no

**Note** - it looks like 802-1x.system-ca-certs gets completely dropped too.

5. Validate the incorrect netplan settings file in /etc/netplan, and broken keyfile in /run/NetworkManager/system-connections.

network-manager snap version: 1.36.6-8 r873 22/stable

[Lukas Märdian (slyon)]

This sounds like a duplicate of bug #2039825

Also see this PR for a more complete solution: https://github.com/canonical/netplan/pull/416

[Tony Espy (awe)]

Thanks, I did search the bug list and saw that bug, but while close, it doesn't seem to be the exact bug. The description reads:

"When a Network Manager connection that uses EAP for authentication is created, libnetplan's keyfile parser
(the code that loads Network Manager's keyfile into Netplan state), will end up generating a broken
configuration when the EAP method is not supported.

The key phrase being "when the EAP method is not supported". I also look over the first patch (which has been merged) and it just seens to add support for two new methods, LEAP (lightweight EAP) and PWD (EAP Password).

https://github.com/canonical/netplan/pull/415/files

The second patchset seems primarily to address the fact that psk and eap password should be useable together. That said, if you feel strongly that it will address my bug, I can try to build and test it?

[Danilo Egea Gondolfo (danilogondolfo)]

It seems to actually be a duplicate of this bug #2016625

It was fixed in this PR https://github.com/canonical/netplan/pull/358

But apparently it didn't make it to Jammy.

[Lukas Märdian (slyon)]

This seems to work for me (partly) on Noble in LXD, using NetworkManager from the archive.

root@nn-eap:~# dpkg -l | grep network-manager
ii network-manager 1.44.2-1ubuntu2
root@nn-eap:~# dpkg -l | grep netplan.io
ii netplan.io 0.107-5ubuntu1

Note the change in the "nmcli" command about "802-1x.system-certificate" and "wifi-sec.auth", which seem invalid.

I say "partly", because I'm not sure if the "system-ca-certificate" setting is correctly handled. The "peap" method seems to be handled OK, though.

root@nn-eap:~# nmcli con add type wifi con-name "mywifi" ifname "wlp4s0" ssid "mywifi" wifi-sec.auth-alg open wifi-sec.key-mgmt wpa-eap 802-1x.eap peap 802-1x.identity "myid" 802-1x.password "mypassword" 802-1x.phase2-auth mschapv2 802-1x.system-ca-certs no
Connection 'mywifi' (eb3b9787-d66b-42ef-95c6-7eaebaf7da50) successfully added.
root@nn-eap:~# cat /etc/netplan/90-NM-eb3b9787-d66b-42ef-95c6-7eaebaf7da50.yaml
network:
  version: 2
  wifis:
    NM-eb3b9787-d66b-42ef-95c6-7eaebaf7da50:
      renderer: NetworkManager
      match:
        name: "wlp4s0"
      dhcp4: true
      dhcp6: true
      access-points:
        "mywifi":
          auth:
            key-management: "eap"
            method: "peap"
            identity: "myid"
            phase2-auth: "mschapv2"
            password: "mypassword"
          networkmanager:
            uuid: "eb3b9787-d66b-42ef-95c6-7eaebaf7da50"
            name: "mywifi"
            passthrough:
              wifi-security.auth-alg: "open"
              ipv6.addr-gen-mode: "default"
              ipv6.ip6-privacy: "-1"
              proxy._: ""
      networkmanager:
        uuid: "eb3b9787-d66b-42ef-95c6-7eaebaf7da50"
        name: "mywifi"

[Lukas Märdian (slyon)]

Actually, when changing "system-ca-certs" to "yes" (non-default value), it shows up:

networkmanager:
  passthrough:
    802-1x.system-ca-certs: "true"

[Tony Espy (awe)]

Thanks @danilogondolfo, that indeed looks like it's the same bug!

[Tony Espy (awe)]

@danilogondolfo @slyon

Actually it does look like it made it into Jammy, I checked and the debian/changelog for 0.106.1-7ubuntu0.22.04.1 lists the commit as back-ported.

The reason it fails for me is that the core22 snap hasn't had a netplan update in quite some time, and still includes version 0.105+really0.104-0ubuntu2.1.

We discussed this during our system-snaps meeting earlier today, and according to Alfonso, updating netplan in core20 and core22 is in currently in progress.

[Tony Espy (awe)]

FYI, I re-tested my original scenario on Desktop 22.04 after refreshing the core22 snap (version: 20231123 / revision: 1033) from the beta channel, and I was able to successfully create a WPA2 Enterprise PEAP connection.