netplan: can't login to ap mode with psk

Bug #1893563 reported by shemgp
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
NetworkManager
Fix Released
Unknown
network-manager (Ubuntu)
Fix Released
Medium
Unassigned
wpa (Ubuntu)
Fix Released
Medium
Unassigned

Bug Description

I've setup my wifi cards as ap over a bridge using netplan.
If I add:

auth:
  key-management: psk
  password: "testinglang"

then my clients are unable to connect.
If I remove those lines above in netplan then the clients are able to connect but without a password.

If I run wpa_cli -i wlp3s0 status, I get:

bssid=4c:1d:96:71:a3:90
freq=2412
ssid=walad2
id=0
mode=AP
pairwise_cipher=CCMP+TKIP
group_cipher=TKIP
key_mgmt=UNKNOWN
wpa_state=COMPLETED
p2p_device_address=4c:1d:96:71:a3:91
address=4c:1d:96:71:a3:90
uuid=85d86b40-7e3d-5fc5-b5fc-aae9af55b29a

I notice that key_mgmt=UNKNOWN. Perhaps that's the problem?

Any pointers on how to debug and fix this?

ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: netplan.io 0.99-0ubuntu3~20.04.2
ProcVersionSignature: Ubuntu 5.4.0-42.46-generic 5.4.44
Uname: Linux 5.4.0-42-generic x86_64
ApportVersion: 2.20.11-0ubuntu27.8
Architecture: amd64
CasperMD5CheckResult: pass
Date: Sun Aug 30 23:11:48 2020
InstallationDate: Installed on 2020-08-16 (14 days ago)
InstallationMedia: Ubuntu-Server 20.04.1 LTS "Focal Fossa" - Release amd64 (20200731)
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: netplan.io
UpgradeStatus: No upgrade log present (probably fresh install)

CVE References

Revision history for this message
shemgp (shemgp) wrote :
Revision history for this message
shemgp (shemgp) wrote :

Here's my netplan config.

Revision history for this message
shemgp (shemgp) wrote :
Revision history for this message
shemgp (shemgp) wrote :

I just that my uploaded config was wrong. Here's the correct one.

Revision history for this message
shemgp (shemgp) wrote :
Revision history for this message
shemgp (shemgp) wrote :

Turns out NM can't make AP under bridge because it's not passing BridgeIfname: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/83

Revision history for this message
shemgp (shemgp) wrote :
Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "Patch to pass BridgeIfname to wpa_supplicant" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags: added: patch
Mathew Hodson (mhodson)
affects: netplan.io (Ubuntu) → network-manager (Ubuntu)
Mathew Hodson (mhodson)
Changed in network-manager (Ubuntu):
importance: Undecided → Medium
Revision history for this message
Sebastien Bacher (seb128) wrote :

could you do a merge request upstream for your change?

Revision history for this message
Sebastien Bacher (seb128) wrote :

Updating the bug since it seems that has been proposed for merging now

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/638

Changed in network-manager (Ubuntu):
status: New → Triaged
Revision history for this message
Mathew Hodson (mhodson) wrote :
Changed in wpasupplicant (Ubuntu):
importance: Undecided → Medium
Mathew Hodson (mhodson)
affects: wpasupplicant (Ubuntu) → wpa (Ubuntu)
Changed in wpa (Ubuntu):
status: New → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package wpa - 2:2.9-1ubuntu10

---------------
wpa (2:2.9-1ubuntu10) hirsute; urgency=medium

  * debian/patches/git_dbus_bridge.patch
    - Allow changing an interface bridge via D-Bus (lp: #1893563)

  [ Andrej Shadura ]
  * Security fix: CVE-2020-12695.
    A vulnerability in the UPnP SUBSCRIBE command can trigger the AP to
    initiate a HTTP (TCP/IP) connection to an arbitrary URL or to trigger
    misbehavior in hostapd and cause the process to either get terminated
    or to start using more CPU resources.
    The issue can also be mitigated by building hostapd without UPnP support
    (CONFIG_WPS_UPNP=n) or disabling it at runtime by removing the upnp_iface
    parameter.
    (Closes: #976106)

  [ Paolo Pisati ]
  * debian/patches/nl80211-Unbreak-mode-processing-due-to-presence-of-S.patch:
    - backport upstream fix (commit 52a1b28345123c374fd0127cbce623c41a760730)
      for S1G band (lp: #1912609)

 -- Sebastien Bacher <email address hidden> Thu, 28 Jan 2021 15:10:07 +0100

Changed in wpa (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Sebastien Bacher (seb128) wrote :

The network manager change landed in git master commit ae31b4bf

Changed in network-manager (Ubuntu):
status: Triaged → Fix Committed
Revision history for this message
Andrej Shadura (andrew.sh) wrote :

@seb128, @mhodson, @shemgp, has this patch been submitted to the upstream?

Revision history for this message
Andrej Shadura (andrew.sh) wrote :

I’ve just verified and in fact not only this hasn’t been submitted upstream, but the upstream has shipped an alternative implementation of this by Beniamino Galvani (@bengal).

I’d really appreciate if Ubuntu didn’t add non-trivial patches without discussion with the upstream and me as the Debian maintainer for this package.

Revision history for this message
Andrej Shadura (andrew.sh) wrote :

Right, my apologies, I was too quick to be angry: I only checked the patch proposed here but not the actual one committed — and apparently I haven’t read the discussion to the end.

Having checked the actual package, I see it is in fact a patch from the upstream Git.

Still, it’d be great if you could at least notify me, and it would be much better if we could first push such changes into Debian first.

Revision history for this message
Mathew Hodson (mhodson) wrote :

network-manager (1.30.0-1ubuntu1) hirsute; urgency=medium

  * Resynchronize on Debian, remaining changes:
    - Use systemd-resolved instead of dnsmasq
    - debian/control:
      + Depend on isc-dhcp-client instead of recommends
      + Recommend network-manager-pptp
      + Suggest avahi-autoipd for IPv4LL support
    - debian/rules, debian/network-manager.postinst:
      + Don't restart NetworkManager on upgrade but recommend restarting
        the computer
    - debian/rules, debian/network-manager.postinst:
      + Don't install sysvinit scripts or migrate from sysvinit
    - debian/network-manager.postinst:
      + Don't add the netdev group.
      + drop in an empty override file for NetworkManager to manage all
        devices for upgrade from any version, as long as there is no
        netplan configuration yet.
    - debian/default-wifi-powersave-on.conf, debian/rules:
      + Install a config file to enable WiFi powersave
    - Enable build tests
    - Add autopkgtests
    - debian/source_network-manager.py, debian/network-manager.install,
      debian/network-manager.links: Add apport hook
    - Add network-manager-config-connectivity-ubuntu package
    - NetworkManager.conf: disable MAC randomization feature. There is no
      easy way for desktop users to disable this feature yet. And there are
      reports that it doesn't work well with some systems.
    - Update Vcs links to point to Ubuntu branch
    - Add patches. See patch descriptions for more details:
      + Provide-access-to-some-of-NM-s-interfaces-to-whoopsie.patch
      + Update-dnsmasq-parameters.patch
      + Disable-general-with-expect.patch
      + libnm-Check-self-still-NMManager-or-not.patch
      + dns-manager-don-t-merge-split-DNS-search-domains.patch (but disabled)
      + Read-system-connections-from-run.patch
    - debian/tests/urfkill-integration - don't stop/start network manager
    - debian/patches/ubuntu_revert_systemd.patch:
      + temporarly revert an upstream commit that made udev enabled under lxc,
        the new systemd doesn't work there (lp: #1914062)

 -- Sebastien Bacher <email address hidden> Thu, 25 Feb 2021 15:30:59 +0100

Changed in network-manager (Ubuntu):
status: Fix Committed → Fix Released
Changed in network-manager:
status: Unknown → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.