Can’t connect to VPN from GNOME Shell

Bug #985788 reported by Anders Kaseorg on 2012-04-19
70
This bug affects 15 people
Affects Status Importance Assigned to Milestone
gnome-shell (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Quantal
Low
Unassigned
network-manager-applet (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Quantal
Low
Unassigned
network-manager-openconnect (Ubuntu)
Low
Mathieu Trudel-Lapierre
Precise
Low
Unassigned
Quantal
Low
Mathieu Trudel-Lapierre
network-manager-openvpn (Ubuntu)
Low
Mathieu Trudel-Lapierre
Precise
Low
Unassigned
Quantal
Low
Mathieu Trudel-Lapierre
network-manager-pptp (Ubuntu)
Low
Mathieu Trudel-Lapierre
Precise
Low
Unassigned
Quantal
Low
Mathieu Trudel-Lapierre
network-manager-vpnc (Ubuntu)
Low
Mathieu Trudel-Lapierre
Precise
Low
Unassigned
Quantal
Low
Mathieu Trudel-Lapierre

Bug Description

I have two VPNs configured with network-manager-openconnect, and I can’t connect to either one of them within GNOME Shell. When I select them from the gnome-shell network menu, nothing happens. No new message show up in ~/.xsession-errors, although I got this one on login:

** Message: Stopping registered applet secret agent because GNOME Shell is running

In a GNOME Classic session, the VPNs work fine.

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: network-manager-openconnect 0.9.4.0-0ubuntu1
ProcVersionSignature: Ubuntu 3.2.0-23.36-generic 3.2.14
Uname: Linux 3.2.0-23-generic x86_64
NonfreeKernelModules: openafs
ApportVersion: 2.0.1-0ubuntu5
Architecture: amd64
Date: Thu Apr 19 13:55:48 2012
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Alpha amd64 (20101202)
SourcePackage: network-manager-openconnect
UpgradeStatus: No upgrade log present (probably fresh install)

Anders Kaseorg (andersk) wrote :

I can't reproduce this with -vpnc or -pptp, so we'll assume it's specific to -openconnect.

Can you make sure that at least libnm-gtk-0/libnm-gtk-common are installed on your system, and which version they're at?

Changed in network-manager-openconnect (Ubuntu):
status: New → Incomplete
importance: Undecided → Low
Anders Kaseorg (andersk) wrote :

Yeah, I have these packages installed:

gir1.2-networkmanager-1.0 0.9.4.0-0ubuntu3
libnm-glib-vpn1 0.9.4.0-0ubuntu3
libnm-glib4 0.9.4.0-0ubuntu3
libnm-util2 0.9.4.0-0ubuntu3
network-manager 0.9.4.0-0ubuntu3

libnm-gtk-common 0.9.4.1-0ubuntu2
libnm-gtk0 0.9.4.1-0ubuntu2
network-manager-gnome 0.9.4.1-0ubuntu2

libopenconnect1 3.15-0ubuntu2
openconnect 3.15-0ubuntu2

network-manager-openconnect 0.9.4.0-0ubuntu1
network-manager-openconnect-gnome 0.9.4.0-0ubuntu1

gnome-shell 3.4.1-0ubuntu2
gnome-shell-common 3.4.1-0ubuntu2

Changed in network-manager-openconnect (Ubuntu):
status: Incomplete → New
Clint Martin (clintlmartin) wrote :

I have the same problem -- after performing an update today my VPN (vpnc based) fails to prompt me for a password. I get the same error in my .xsession-errors as reported. I also see in my syslog when trying to start the VPN:

Apr 19 15:30:27 cft-dv7 NetworkManager[1281]: <error> [1334863827.142391] [nm-vpn-connection.c:934] get_secrets_cb(): Failed to request VPN secrets #3: (6) No agents were available for this request.

I do have libnm-gtk-0 and libnm-gtk-common 0.9.4.1-0ubuntu2 installed.

Clint Martin (clintlmartin) wrote :

I just re-installed libnm-gtk0 and libnm-gtk-common via synaptic. logged-out-back-in and now am being prompted for my VPN credentials.

Is nm-applet running?

My system is fully updated and all the vpn plugins I'm trying work just fine, there has to be something else at play..

Changed in network-manager-openconnect (Ubuntu):
status: New → Incomplete
Anders Kaseorg (andersk) wrote :

Huh. While constructing the above list, I removed some -dev packages on a whim:

libnm-glib-dev 0.9.4.0-0ubuntu3
network-manager-dev 0.9.4.0-0ubuntu3
libnm-util-dev 0.9.4.0-0ubuntu3
libopenconnect-dev 3.15-0ubuntu2

And then when I logged out and logged in, my VPN started working in GNOME Shell again. Then I played with reinstalling and uninstalling them a few times; for a while the problem seemed to be correlated with network-manager-dev being installed, but now I have them all installed again and the VPN works anyway.

So, uh, yeah. I guess this can be closed for now.

Anders Kaseorg (andersk) wrote :

I’m still a little concerned, though, since the intent of the code that was generated the “Stopping registered applet secret agent” error message is clearly to disable the agent when GNOME Shell ≥ 3.4 is running. That message no longer appears for me. Maybe the only reason my VPN works now is that I managed to trigger some kind race condition that prevents nm-applet from detecting GNOME Shell?

Closing as Invalid since the resolution is unclear.

Changed in network-manager-openconnect (Ubuntu):
status: Incomplete → Invalid
Anders Kaseorg (andersk) on 2012-04-27
Changed in network-manager-openconnect (Ubuntu):
status: Invalid → New
Anders Kaseorg (andersk) wrote :

This still happens occasionally for me on login, but I figured out that I can reproduce it deterministically if I restart nm-applet while gnome-shell is running:

$ pkill nm-applet
$ nm-applet &
[1] 9146
** Message: applet now removed from the notification area
** Message: applet now embedded in the notification area
** Message: applet now removed from the notification area
** Message: Stopping registered applet secret agent because GNOME Shell is running
** Message: using fallback from indicator to GtkStatusIcon
** Message: applet now embedded in the notification area

Now the VPN doesn’t work, and gnome-shell logs this error:

      JS LOG: Error 'VPN plugin at /usr/lib/gnome-shell/nm-openconnect-auth-dialog is not executable' while processing VPN keyfile '/etc/NetworkManager/VPN/nm-openconnect-service.name'
      JS LOG: Error 'VPN plugin at /usr/lib/gnome-shell/nm-pptp-auth-dialog is not executable' while processing VPN keyfile '/etc/NetworkManager/VPN/nm-pptp-service.name'
      JS LOG: Invalid VPN service type (cannot find authentication binary)

$ pkill gnome-shell
$ pkill nm-applet
$ nm-applet &
[1] 9782
** Message: applet now removed from the notification area
** Message: using fallback from indicator to GtkStatusIcon
$ gnome-shell &

Now when I try to connect to the VPN, gnome-shell logs the same error(!), but now nm-applet takes over and lets me log in and connect.

Anders Kaseorg (andersk) wrote :

I filed bug 990074 for gnome-shell looking in the wrong directory for VPN plugins. So the remaining bug here is that nm-applet should listen for gnome-shell starting or stopping instead of just checking once at startup.

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in network-manager-openconnect (Ubuntu):
status: New → Confirmed
Davide Fiocco (davide-fiocco) wrote :

I have the same error, using Arch Linux.

Same bug here, with Gnome Shell, vpnc and Pangolin. I can't get a password prompt and I get this error in the logs:

May 2 09:33:32 atlantis NetworkManager[1384]: <error> [1335944012.928378] [nm-vpn-connection.c:934] get_secrets_cb(): Failed to request VPN secrets #3: (6) No agents were available for this request.

Kartoch (kartoch) wrote :

Same error for me

NetworkManager[1059]: <error> [1336371536.323900] [nm-vpn-connection.c:934] get_secrets_cb(): Failed to request VPN secrets #3: (6) No agents were available for this request.

Kartoch (kartoch) wrote :

I can confirm that the trick from Anders Kaseorg (anders-kaseorg) #10 is working for me.

Kartoch (kartoch) wrote :

The problem does not appear in unity, so it is related to gnome-shell only.

hemna (dickfardos) wrote :

I have this same exact problem and I can't work from home because of it. This is a high priority for me...not sure why it's listed as low.

May 11 08:06:08 localhost NetworkManager[1758]: <info> VPN service 'openvpn' appeared; activating connections
May 11 08:06:08 localhost NetworkManager[1758]: <error> [1336748768.328562] [nm-vpn-connection.c:934] get_secrets_cb(): Failed to request VPN secrets #3: (6) No agents were available for this request.
May 11 08:06:13 localhost NetworkManager[1758]: <info> VPN service 'openvpn' disappeared

hemna (dickfardos) wrote :

It seems like this defect is a recurring issue with Ubuntu devs and they keep breaking the same problem.

https://bugs.launchpad.net/ubuntu/+source/network-manager-applet/+bug/863120
https://bugs.launchpad.net/ubuntu/+source/network-manager-openconnect/+bug/824255

Johannes H. Jensen (joh) wrote :

I can also confirm that the trick in comment #10 is working for me.

Lukáš Dvorok (d1g1t) wrote :

I have solved this issue on ARCHLINUX creating an symlink:

sudo ln -s /usr/lib/networkmanager/nm-vpnc-auth-dialog /usr/lib/gnome-shell/nm-vpnc-auth-dialog

Davide Fiocco (davide-fiocco) wrote :

I confirm that d1g1t's trick worked fine on Arch Linux for me as well. Thanks!

Seems like http://git.gnome.org/browse/network-manager-applet/commit/?id=0c997a95d5b82ea6733e001478db1e2490b49575 might help a lot here; I'll see about applying this as a SRU to Precise.

affects: network-manager-openconnect (Ubuntu) → network-manager-applet (Ubuntu)
no longer affects: network-manager-openconnect
Changed in network-manager-applet (Ubuntu):
status: Confirmed → In Progress
assignee: nobody → Mathieu Trudel-Lapierre (mathieu-tl)
Changed in network-manager-applet (Ubuntu Precise):
status: New → Triaged
importance: Undecided → Low
assignee: nobody → Mathieu Trudel-Lapierre (mathieu-tl)
Anders Kaseorg (andersk) wrote :

Mathieu: I’m worried that fixing nm-applet’s gnome-shell detection code, without first fixing gnome-shell’s location to look for NM plugins (which should be /usr/lib/network-manager instead of /usr/lib/gnome-shell), will cause this to break all the time, instead of just when gnome-shell doesn’t lose the startup race.

Anders Kaseorg (andersk) wrote :

(Er, of course I mean /usr/lib/NetworkManager.)

I am additionally worried that, on my quantal system at least, when I symlink nm-openconnect-auth-dialog into the wrong /usr/lib/gnome-shell location and restart nm-applet while gnome-shell is running, then gnome-shell segfaults in shell_network_agent_set_password() when I connect to a VPN.

So there are probably three bugs here that roughly cancel each other out, and we need to be very careful about what order we fix them in, especially for a precise SRU.

Anders Kaseorg (andersk) wrote :

> Mathieu: I’m worried that fixing nm-applet’s gnome-shell detection code, without first
> fixing gnome-shell’s location to look for NM plugins (which should be
> /usr/lib/network-manager instead of /usr/lib/gnome-shell), will cause this to break all
> the time, instead of just when gnome-shell doesn’t lose the startup race.

This appears to be exactly what happened with the upload of network-manager-applet 0.9.6.0~git201207161252.13c6db8-0ubuntu1. Now it’s _always_ impossible to connect to a VPN from gnome-shell, even when nm-applet is started first.

$ nm-applet &

** (nm-applet:29893): WARNING **: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-Uvn8AW90K7: Connection refused
** Message: applet now removed from the notification area
** Message: using fallback from indicator to GtkStatusIcon
$ gnome-shell &

** (gnome-shell:29899): WARNING **: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-Uvn8AW90K7: Connection refused
      JS LOG: Error: Requiring IBus, version none: Typelib file for namespace 'IBus' (any version) not found

** (gnome-shell-calendar-server:29910): WARNING **: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-Uvn8AW90K7: Connection refused
      JS LOG: GNOME Shell started at Wed Jul 18 2012 19:53:08 GMT-0400 (EDT)
** Message: applet now embedded in the notification area
** Message: Stopping applet secret agent because GNOME Shell appeared
$ [try to connect to a VPN]
      JS LOG: Error 'VPN plugin at /usr/lib/gnome-shell/nm-openconnect-auth-dialog is not executable' while processing VPN keyfile '/etc/NetworkManager/VPN/nm-openconnect-service.name'
      JS LOG: Error 'VPN plugin at /usr/lib/gnome-shell/nm-pptp-auth-dialog is not executable' while processing VPN keyfile '/etc/NetworkManager/VPN/nm-pptp-service.name'
      JS LOG: Invalid VPN service type (cannot find authentication binary)

Will look into why gnome-shell doesn't use the right libexec dir; must simply have been overlooked.

Changed in gnome-shell (Ubuntu Precise):
status: New → Triaged
importance: Undecided → Low
Changed in network-manager-applet (Ubuntu Quantal):
status: In Progress → Fix Released
Changed in gnome-shell (Ubuntu Quantal):
status: New → In Progress
importance: Undecided → Low
assignee: nobody → Mathieu Trudel-Lapierre (mathieu-tl)
Changed in network-manager-applet (Ubuntu Precise):
assignee: Mathieu Trudel-Lapierre (mathieu-tl) → nobody

nm-applet and gnome-shell appear to be doing the right thing: gnome-shell adds its own LIBEXECDIR if the path isn't absolute, and nm-applet always strips out the path to use its own LIBEXECDIR (which would be the right one anyway).

I'll look at all the VPN plugins and test if adding the libexecdir as path to the auth-dialog would be sufficient to correctly fix this.

Changed in gnome-shell (Ubuntu Quantal):
status: In Progress → Invalid
Changed in gnome-shell (Ubuntu Precise):
status: Triaged → Invalid
Changed in gnome-shell (Ubuntu Quantal):
assignee: Mathieu Trudel-Lapierre (mathieu-tl) → nobody
Changed in network-manager-applet (Ubuntu Precise):
status: Triaged → Invalid
Changed in network-manager-applet (Ubuntu Quantal):
status: Fix Released → Invalid
assignee: Mathieu Trudel-Lapierre (mathieu-tl) → nobody
Changed in network-manager-pptp (Ubuntu Precise):
importance: Undecided → Low
status: New → Triaged
Changed in network-manager-pptp (Ubuntu Quantal):
assignee: nobody → Mathieu Trudel-Lapierre (mathieu-tl)
importance: Undecided → Low
status: New → In Progress
Changed in network-manager-vpnc (Ubuntu Precise):
importance: Undecided → Medium
status: New → Triaged
importance: Medium → Low
Changed in network-manager-vpnc (Ubuntu Quantal):
assignee: nobody → Mathieu Trudel-Lapierre (mathieu-tl)
importance: Undecided → Low
status: New → In Progress
Changed in network-manager-openvpn (Ubuntu Precise):
importance: Undecided → Low
status: New → Triaged
Changed in network-manager-openvpn (Ubuntu Quantal):
assignee: nobody → Mathieu Trudel-Lapierre (mathieu-tl)
importance: Undecided → Low
status: New → In Progress
Changed in network-manager-openconnect (Ubuntu Precise):
importance: Undecided → Low
status: New → Triaged
Changed in network-manager-openconnect (Ubuntu Quantal):
assignee: nobody → Mathieu Trudel-Lapierre (mathieu-tl)
importance: Undecided → Low
status: New → In Progress
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package network-manager-vpnc - 0.9.6~git201207121441.383f3dc-0ubuntu2

---------------
network-manager-vpnc (0.9.6~git201207121441.383f3dc-0ubuntu2) quantal; urgency=low

  * debian/patches/auth-dialog-libexecdir.patch: set libexecdir for the auth
    dialog; so that the dialog can be properly started by GNOME Shell.
    (LP: #985788)
 -- Mathieu Trudel-Lapierre <email address hidden> Fri, 20 Jul 2012 11:15:20 -0400

Changed in network-manager-vpnc (Ubuntu Quantal):
status: In Progress → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package network-manager-openconnect - 0.9.5.95-0ubuntu1

---------------
network-manager-openconnect (0.9.5.95-0ubuntu1) quantal; urgency=low

  * New upstream release.
    - Use gnome-keyring for password fields. (LP: #799701)
  * debian/patches/04_fix-hitting-cancel-after-failure.patch,
    debian/patches/02_fix-ignoring-return-value.patch,
    debian/patches/01_implement-proper-cancellation.patch: dropped, these
    patches are included in the 0.9.5.95 release.
  * debian/patches/dont_fail_if_no_ip6_714dea4.patch: don't fail activation
    if there is no IPv6 address passed. Some people still don't have IPv6...
  * debian/control:
    - update Build-Depends to require NM >= 0.9.5.95.
    - add libgnome-keyring-dev to Build-Depends.
  * debian/patches/auth_dialog_libexecdir.patch: specify libexecdir as
    /usr/lib/NetworkManager for the auth dialog to be able to spawn it properly
    in GNOME Shell. (LP: #985788)
 -- Mathieu Trudel-Lapierre <email address hidden> Fri, 20 Jul 2012 16:44:24 -0400

Changed in network-manager-openconnect (Ubuntu Quantal):
status: In Progress → Fix Released

Anders,

Please try the network-manager-openconnect package in Quantal, and let me know if it properly fixes the issue for you :)

Changed in network-manager-openvpn (Ubuntu Quantal):
status: In Progress → Fix Released
Changed in network-manager-pptp (Ubuntu Quantal):
status: In Progress → Fix Released
status: Fix Released → In Progress
Changed in network-manager-openvpn (Ubuntu Quantal):
status: Fix Released → In Progress
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package network-manager-pptp - 0.9.6.0-0ubuntu1

---------------
network-manager-pptp (0.9.6.0-0ubuntu1) quantal; urgency=low

  * New upstream release.
  * debian/control: bump Build-Depends for network-manager libs.
  * debian/patches/auth_dialog_libexecdir.patch: specify libexecdir as
    /usr/lib/NetworkManager for the auth dialog to be able to spawn it properly
    in GNOME Shell. (LP: #985788)
 -- Mathieu Trudel-Lapierre <email address hidden> Wed, 08 Aug 2012 17:41:25 -0400

Changed in network-manager-pptp (Ubuntu Quantal):
status: In Progress → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package network-manager-openvpn - 0.9.6.0-0ubuntu2

---------------
network-manager-openvpn (0.9.6.0-0ubuntu2) quantal; urgency=low

  * debian/patches/auth_dialog_libexecdir.patch: specify libexecdir as
    /usr/lib/NetworkManager for the auth dialog to be able to spawn it properly
    in GNOME Shell. (LP: #985788)
 -- Mathieu Trudel-Lapierre <email address hidden> Fri, 10 Aug 2012 14:25:07 -0400

Changed in network-manager-openvpn (Ubuntu Quantal):
status: In Progress → Fix Released
Jeremy Bicha (jbicha) wrote :

Debian added this patch to gnome-shell 3.4.2, which I guess means you can drop the network-manager vpn plugin patches in raring:

http://anonscm.debian.org/viewvc/pkg-gnome/desktop/unstable/gnome-shell/debian/patches/27-nm-libexec-path.patch?view=markup

Mike Miller (mtmiller) wrote :

You could, but keep in mind this patch was added simply to avoid needing to coordinate updating all of the vpn plugins in Debian post-freeze.

https://lists.debian.org/debian-release/2012/07/msg01693.html

I hope/expect that upstream will incorporate the auth_dialog_libexecdir changes into the plugins. There are already open upstream bug reports on this.

Mako' (mako82) wrote :

The same here, again.
Gnome 3.12
UbuntuGnome 14.04 beta2

Is there a way to fix it?

Mike Miller (mtmiller) wrote :

Hi Mako', instead of commenting on this dormant and resolved bug in an old Ubuntu release, you might want to look at the recently reported #1300097, you might also be affected by that bug. Or if that bug does not apply to you, you might consider reporting a new bug since the problem you are experiencing may not be related to this bug report.

https://bugs.launchpad.net/bugs/1300097

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers