We have moved to a new Sailfish OS Forum. Please start new discussions there.
8

Connman fails due to case-sensitive settings

asked 2014-09-12 23:27:10 +0300

stitran gravatar image

updated 2014-09-15 11:50:08 +0300

chemist gravatar image

Hi,

I am not an expert at this topic, so I'll try to describe as detailed as possible, how I am able to connect to the WLAN at my university (using my laptop running Arch Linux as well as using my Jolla with a manual configuration/connman disabled) and what seems to be the problem using Jolla with connman.

This is my working wpa_supplicant config file for the laptop:

network={
ssid="eduroam"
key_mgmt=WPA-EAP
eap=TTLS
proto=WPA RSN
identity="myusername"
anonymous_identity="anonymous@uni-xyz.de"
password="mypassword"
ca_cert="/path/to/certificate/Deutsche_Telekom_Root_CA_2.crt"
phase2="auth=PAP"
}

which as well works with wpa_supplicant on my Jolla if I configure the WLAN adapter manually, i.e. step by step:

# first I have to kill connman
devel-su
systemctl stop connman
# setting up wpa_supplicant
wpa_supplicant -Dwext -iwlan0 -c/etc/wpa_supplicant/eduroam.conf
# I get an IP-address with udhcpc that has to be added manually
udhcpc -iwlan0
ip addr add <ip I got from udhcpc/suffix> dev wlan0
# The default gateway and DNS information stay constant 
ip route add default via 'address of default gateway at my uni'
# then I add some lines to /etc/resolv.conf:
    domain nac.uni-xyz.de
    nameserver <nameserver ip>

This leads to a working internet connection but obviously is not very comfortable, because connman has to be stopped...

I have tried to create a connman config file /var/lib/connman/wifi_eduroam.config with the following content but there is a problem while trying to set up the connection.

/var/lib/connman/wifi_eduroam.config

[service_eduroam]
Type=wifi
Name=eduroam
EAP=TTLS
CACertFile=/path/to/certificate/Deutsche_Telekom_Root_CA_2.crt
Phase2=PAP
Identity=myidentity@uni-xyz.de
Passphrase=mypassphrase

I guess, that the connection fail is linked to the lack of a config parameter for anonymous_identity in connman according to connman/connman.git.

Well, as I already said, I am not an expert, so please forgive me, if this problem has been solved already or if there is some stupid mistake ;)

For me personally it would suffice if there was a possibility to avoid having to stop connman while using the eduroam network. Maybe there is some way to tell connman to use my wpa_supplicant config file?

Thank you

edit retag flag offensive close delete

Comments

1

well, I read this thread, but could not get the workaround using the connman config file working, so I should rather ask, if it is currently possible to get connected to my uni's eduroam using connman. Thanks for your help ;)

stitran ( 2014-09-13 02:38:17 +0300 )edit

Something similar has already been discussed here: https://together.jolla.com/question/15645/connman-does-not-support-setting-up-anonymous-or-outer-eap-identity-for-wifi-wpa-enterprise/ There seems to be no fix currently. My university's eduroam also supports connecting without an outer/anonymous identity but the real solution would of course be to include this in connman.

rod ( 2014-09-13 10:33:30 +0300 )edit

IMO this is a missing features and shouldn't require any workarounds in a proper implication of WLAN connectivity

bennypr0fane ( 2014-09-13 17:09:09 +0300 )edit

1 Answer

Sort by » oldest newest most voted
4

answered 2014-09-13 14:45:53 +0300

chemist gravatar image

updated 2014-09-15 11:48:50 +0300

UPDATE: stitran found out that it is connman's case-sensitive interpretation of the config file so a change in EAP=TTLS to EAP=ttls solved his problem.

@stitran don't change the cacert line - I am at uni-kl.de and had exactly the same problem

 [service_eduroam]
 Type=wifi
 Name=eduroam
 EAP=ttls
 CACertFile=/etc/ssl/certs/ca-bundle.crt
 Phase2=PAP
 Identity=myidentity@uni-xyz.de
 Passphrase=mypassphrase
edit flag offensive delete publish link more

Comments

Thanks for your suggestion, but this seems not to solve the problem. (Connman tries to connect but fails after a while.) At my uni's eduroam some kind of config parameter like anonymous_identity=anonymous@uni-xyz.de is required.

stitran ( 2014-09-13 15:57:06 +0300 )edit

that parameter is said to be needed at uni-kl.de too but it works without it, what does wpa_supplicant tell when connecting (wpa_cli)?

chemist ( 2014-09-13 17:46:21 +0300 )edit

I'm sorry, I am not used to wpa_cli ;) So which output of wpa_cli are you interested in exactly? While connecting successfully or should there be some feedback of wpa_cli while Connman tries to connect, but fails? The config file of uni-kl.de uses three differing parameters (pairwise,group,proto) in comparison to my working wpa_supplicant config file (maybe this is important)

stitran ( 2014-09-14 00:27:27 +0300 )edit

the failing output, it will show what part is failing, the reason why you are unable to connect. For uni-kl.de, my eduroam connman config file is exactly what is shown above. No pairwise or group setting. Well I wrote "ttls" instead of "TTLS" and my file is called wifi_eduroam.config... I tried just as you did, find a way to enter outer identity and use the telekom root cert but that is what I ended up with.

chemist ( 2014-09-14 11:52:08 +0300 )edit
1

It works!! Writing TTLS lowercase solved the problem ;) Thank you very much! I will 'mark your answer as correct' as soon as you edit the eap=ttls line.

stitran ( 2014-09-14 12:16:23 +0300 )edit

it probably was changing the setting that made it work but fine - connman is pretty borked

chemist ( 2014-09-14 14:53:04 +0300 )edit

you mean, just because of updating the config file? I don't think so, because resetting the option back to uppercase makes connman fail again. For me personally it was confusing, that connman uses case sensitive parameters, although they use them in their documentation one time uppercase and the other lowercase...

stitran ( 2014-09-15 03:43:52 +0300 )edit

Can you add logs to your question, please. I will reopen and tag as bug.

chemist ( 2014-09-15 11:45:43 +0300 )edit

According to the config-format description one should use the "EAP-" prefix for Phase2-authentication (see line 79 to 81) with ttls. Probably this solves the issues

je ( 2014-09-15 12:44:34 +0300 )edit
2

Moved my post there if it suits any better.

oku ( 2014-09-15 14:47:50 +0300 )edit
Login/Signup to Answer

Question tools

Follow
3 followers

Stats

Asked: 2014-09-12 23:27:10 +0300

Seen: 2,216 times

Last updated: Sep 15 '14