Re: Problem with changing encryption for established connection

[Dan Williams <dcbw redhat com>]

On Sat, 2009-10-24 at 11:15 +0200, Will Stephenson wrote:
> On Saturday 24 October 2009 00:53:16 Dan Williams wrote:
> > On Thu, 2009-10-22 at 10:45 -0500, Larry Finger wrote:
> > > I am using NetworkManager version 0.7.1 and kNM version 0.9. While
> > > testing openSUSE 11.2 RC1, I did the unusual step of changing the
> > > encryption scheme for a previously established ESSID/connection. As
> > > expected, when I clicked on the entry in the kNM applet to connect, I
> > > got the authentication/secrets pop-up. Supplying the new, correct
> > > password and authentication scheme failed. I could connect only by
> > > using the "Manage Connections" item from the applet and by editing the
> > > wireless connection item before trying to connect.
> > >
> > > Is this expected behavior?
> > 
> > It might be the case that the AP's old encryption settings were still in
> > the scan list; How long was the AP powered off before it came back up
> > with the new settings?  Can you reproduce the situation and run
> > 'nm-tool' to check what NM thinks the AP's settings are and make sure
> > that NM reflects what they really are?  If not, it's likely a stale
> > entry in NM's scan cache.
> > 
> > I'd expect to see the passphrase dialog if you change the passphrase on
> > the AP and not the security settings; if you switch between WEP and WPA
> > for example then you might also see that dialog, but NM might also be a
> > bit confused.
> 
> Agreed, but Larry might also have mis-entered the encryption type on first 
> creating the connection and be trying to edit it in the GetSecrets popup.  I 
> show the whole settings group's UI on GetSecrets because I haven't got round 
> to making a minimal secrets-only UI yet, and I doubt NM is equipped to handle 
> the non-secret parts of 802-11-wireless changing at that point.

I made that work at one point, so that if you did switch from WEP to WPA
it would just ask and you send the new settings.  But at some point I
think that became obsolete, because NM won't even try to connect to your
AP if the connection is WEP, but the AP is WPA; this filtering was
requested mainly for people with 'linksys' default-ssid APs where say
their neighbor was running one with WEP + 'linksys', but the one they
connected to was WPA or something.

In truth we could be smarter about this by detecting the saved BSSID or
something; if no other connection is appropriate for the AP, but you
have a non-matching connection with a scanned AP's BSSID, then maybe we
start that connection and ask for secrets, and allow NM's GetSecrets
response to update the whole 'security' and '8021x' settings.

But that might also be *too* smart.  In the end, I think we play it safe
and if you change the encryption on your AP, you get to pick it from the
menu again.  If you just change the password, NM should eventually let
you know that it can't connect and offer you some way to change the
password, but it shouldn't pop up the interrupt-me-immediately dialog.

Dan