[SRU]handle 802.1x on ethernet properly

[Dan Jared]

[Impact]

nm-applet does not save passwords for 802.1X on Ethernet connections, thus users will need to input password every time when connecting to it.

[Test case]

Connect to an 802.1X enabled Ethernet port, choose save password when authentication. Disconnect the network and reconnect, users should not be prompted again for credentials.

[Regression potential]

The fix is a one liner that only deals with secrets handling of certain time, potential of regression is minimal.

[Sebastien Bacher (seb128)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. The issue you are reporting is an upstream one and it would be nice if somebody having it could send the bug to the developers of the software by following the instructions at https://wiki.ubuntu.com/Bugs/Upstream/GNOME. If you have done so, please tell us the number of the upstream bug (or the link), so we can add a bugwatch that will inform us about its status. Thanks in advance.

[frad666 (frad666)]

this bug was already present in a beta and should be set to a much higher importance as some people like me are not able to get their computers connected to the internet when they do a fresh install of ubuntu 16.04LTS and rely on a 802.1X authentification.

[funny_falcon (funny-falcon)]

It affects my, my teammate and many other people:
https://answers.launchpad.net/ubuntu/+question/293069
http://askubuntu.com/questions/763589/ubuntu-16-04-802-1x
http://askubuntu.com/questions/763633/problem-when-setting-802-1x-authentication-in-ubuntu-16-04
https://plus.google.com/106648970555141530627/posts/jE8c2sYBVix

Literally, it will affect at least 100 people from our company, when their passwords will expire.
While password, entered into 15.10 release, were walid, everything worked.
Today, I ought to change my password. And new password is simply not stored anywhere.
Neither works "ask every time" option, it just appears again and again, without result.

I did the same workaround:
- wrote plaintext password to /etc/NetworkManager/system-connections/ConnectionName
- restart NetworkManager

But it is awful workaround, don't you think so?

[funny_falcon (funny-falcon)]

Why this is "low" priority at all?
In two months you will get a lot of it, cause usual password expire timeout is three months.

[Neon (neonkowy)]

Whu this is even not assigned to anyone? +1 from me

[dan hawk (culori-media)]

Even if I'm gonna repeat what someone else already said. How in the world this bug priority is Low and has no one assigned? This probably affects a ton of users. It took me 20 minutes just to figure out what the problem is. This issue's priority should be raised and fixed asap.

[Martin Evald (martin-evald)]

Surely this can't be considered "Low" priority? Any and all corporate users are going to get bitten by this, and storing the password in plain text as a workaround is just awful.

[Jonathan Byrne (jonathan-yamame)]

This affects me also. I work for a big Silicon Valley company with about 30,000 engineers. Mac is probably the majority platform in engineering, but there are a lot of us using Linux, too. This is kind of a big deal. Except for the fact that 802.1x works on wireless, this would be a BIG deal, because if it didn't work on wireless either, my sole option would be to install the corporate Windows image so that I could work, and relegate Ubuntu to a VM in Windows.

I agree with all those who believe this shouldn't be a low-priority bug. It's a serious problem that affects many people using Ubuntu in the workplace.

I get that it's an upstream bug, but couldn't Ubuntu fix it and submit the patch upstream? I've been using Ubuntu for 12 years (yeah, I go back a ways; switched from Debian) and this is the works usability problem I've ever encountered. I really, really hope you'll consider fixing it and submitting the patch upstream.

[Sebastien Bacher (seb128)]

upstream has a nm-applet patch they would like tested
https://bugzilla.gnome.org/attachment.cgi?id=333114&action=diff

does anyone here having the bug could test it? (let us know if you can build a test package or if you would prefer a ppa to be set up for that). Aron you could maybe help by providing a build for it?

[Aron Xu (happyaron)]

I've set up a dot1x environment using PEAP/MSCHAPv2 with LDAP integration at home, but I haven't seen the problem any time when delete-and-connect to it...

[Martin Evald (martin-evald)]

I would like to test it, but I get compilation errors when I try to build it, unpatched (as retrieved by apt source network-manager-gnome):

applet.c: In function ‘foo_online_offline_deferred_notify’:
applet.c:2241:4: error: suggest explicit braces to avoid ambiguous ‘else’ [-Werror=parentheses]
  if(select_merged_notification_text (info))

applet-device-wifi.c: In function ‘wifi_notify_connected’:
applet-device-wifi.c:1425:68: error: ‘esc_ssid’ is used uninitialized in this function [-Werror=uninitialized]
  g_object_set_data_full (G_OBJECT(device), "canonical-last-essid", g_strdup (esc_ssid), (GDestroyNotify) g_free);

mobile-helpers.c:123:1: error: no previous prototype for ‘mobile_helper_get_mobile_quality_icon_name’ [-Werror=missing-prototypes]
 mobile_helper_get_mobile_quality_icon_name (guint32 quality)

[Martin Evald (martin-evald)]

Maybe that ppa option could be the way to go...?

[Sebastien Bacher (seb128)]

@Martin, sorry Aron was supposed to help providing a deb to test but he seems too busy for that, I'm going to have a look today and come back to you

[Aron Xu (happyaron)]

@Martin, I'm sorry for the delay, could you please try the package in this PPA?

https://launchpad.net/~happyaron/+archive/ubuntu/lp1579246

Add the ppa, sudo apt-get update && sudo apt-get upgrade should do the work.

[Martin Evald (martin-evald)]

Hi, my time to say sorry for the delay. I've tried it out, and the proposed patch seems to do the trick - I could enter the password and then it connected. Left a comment at the GNOME bug tracker: https://bugzilla.gnome.org/show_bug.cgi?id=769661

[Sebastien Bacher (seb128)]

Great, thanks for testing. Aron, can we get an SRU for that one?

[Brian Murray (brian-murray)]

Hello Dan, or anyone else affected,

Accepted network-manager-applet into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/network-manager-applet/1.2.0-0ubuntu0.16.04.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Launchpad Janitor (janitor)]

This bug was fixed in the package network-manager-applet - 1.2.2-0ubuntu2

---------------
network-manager-applet (1.2.2-0ubuntu2) yakkety; urgency=medium

  * Fix handling of 802.1x secrets for ethernet connections (LP: #1579246)

 -- Aron Xu <email address hidden> Thu, 18 Aug 2016 17:31:26 +0800

[Dan Jared (danjaredg)]

I checked the package "network-manager 1.2.2" and all is working ok, thanks

[Marco B. (boro3k)]

I also checked the package in "proposed", and it seems to correctly save the password, although I still had to enter the password once in addition after writing it into the connection creation window. Thank you.

[Martin Pitt (pitti)]

The verification of the Stable Release Update for network-manager-applet has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package network-manager-applet - 1.2.0-0ubuntu0.16.04.4

---------------
network-manager-applet (1.2.0-0ubuntu0.16.04.4) xenial; urgency=medium

  * debian/patches/lp1579246_fix_handling_8021x_secrets_for_eth.patch
    - fix handling of 802.1x secrets for ethernet connections (LP: #1579246)

 -- Aron Xu <email address hidden> Thu, 18 Aug 2016 17:41:42 +0800