Bug#1020495: Error: unable to load VPN connection editor - on Identity tab at Gnome Network manager VPN

[Patrik Svestka]

Package: strongswan-nm
Version: 5.9.6-1+b1
Severity: important
X-Debbugs-Cc: patrik....@gmail.com

Dear Maintainer,

* What led up to the situation?
I wanted to to configure IPSec client via the Network Manager and the strongswan.

* What exactly did you do (or not do) that was effective (or
ineffective)?
The only workaround I found is to use `nm-connection-editor` where you can create
the IPSec configuration configuration which is then shown in the VPN overview.
You can't still see it in the Identity tab even when created.
You have to always use `nm-connection-editor` even for editing.

* What was the outcome of this action?
With the `nm-connection-editor` you can edit it, but you can not do that via network-manager!

* What outcome did you expect instead?
To see VPN connection editor for the IPsec/IKEv2(strongswan) on the Identity tab.

Versions of the packages that could influence the application (beside the below reported):

strongswan-nm/testing,now 5.9.6-1+b1 amd64 [installed]
strongSwan plugin to interact with NetworkManager

network-manager-strongswan/testing,now 1.6.0-1 amd64 [installed,automatic]
network management framework (strongSwan plugin)

network-manager/testing,now 1.40.0-1 amd64 [installed,automatic]
network management framework (daemon and userspace tools)

network-manager-gnome/testing,now 1.28.0-1 amd64 [installed,automatic]
network management framework (GNOME frontend)


-- System Information:
Debian Release: bookworm/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.19.0-1-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages strongswan-nm depends on:
ii libc6 2.34-7
ii libglib2.0-0 2.73.3-3
ii libnm0 1.40.0-1
ii libstrongswan 5.9.6-1+b1
ii strongswan-libcharon 5.9.6-1+b1

Versions of packages strongswan-nm recommends:
ii network-manager-strongswan 1.6.0-1

strongswan-nm suggests no packages.

-- no debconf information

[Tobias Brunner]

Hi Patrik,

> * What was the outcome of this action?
> With the `nm-connection-editor` you can edit it, but you can not do that via network-manager!

That's because the settings app uses GTK 4, while `nm-connection-editor`
still uses GTK 3. In order for the strongSwan plugin to work with GTK
4, it has to be built with `--with-gkt4`. That creates an additional
version of the editor that's linked against GTK 4 (besides the one
linked against GTK 3). These are actually two shared libraries that are
loaded dynamically at runtime by the main editor plugin depending on
whether it's loaded by a GTK 3 or 4 application.

Regards,
Tobias

[Yves-Alexis Perez]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Thu, 2022-09-22 at 11:44 +0200, Tobias Brunner wrote:
> That's because the settings app uses GTK 4, while `nm-connection-editor`
> still uses GTK 3.  In order for the strongSwan plugin to work with GTK
> 4, it has to be built with `--with-gkt4`.  That creates an additional
> version of the editor that's linked against GTK 4 (besides the one
> linked against GTK 3).  These are actually two shared libraries that are
> loaded dynamically at runtime by the main editor plugin depending on
> whether it's loaded by a GTK 3 or 4 application.

Ah, thanks for the information. So that means at some point we should enable
that in our build I guess.

Regards,
- --
Yves-Alexis
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAmMsiaEACgkQ3rYcyPpX
RFv8dAf/Tr3M8QfC2G5BZyRV6vK8I2W7CS5ckiQzqbWy+/1T/KdfPO6sE9m99zGA
JXAU6up71pqpIcXNUynIPUkbCTy+B+FESzDRczPo0eNvTWG6WJsWIIcHuYEyVDgd
5Inh8QSHQrOhecPgisYx58KtYu7DLLINbceCwlzEW+v5WivzfYrrQ73fi6pmruof
gj/uKZktVXvg1cThKzaKw92mnwARJ6IQnWe1sqNvoF3ro8z+0KPvEbWBNMmhjzNE
0feUaGlwC7cAY7IyWnIhp43Rd6xbajAgK2c4dpRvgRaMNjhWYjWb+og+0qjpXHoO
Kugs8kn0X4AC6DJ/siw/BgPPHaKdUw==
=ltIE
-----END PGP SIGNATURE-----

[Tobias Brunner]

>> That's because the settings app uses GTK 4, while `nm-connection-editor`
>> still uses GTK 3. In order for the strongSwan plugin to work with GTK
>> 4, it has to be built with `--with-gkt4`. That creates an additional
>> version of the editor that's linked against GTK 4 (besides the one
>> linked against GTK 3). These are actually two shared libraries that are
>> loaded dynamically at runtime by the main editor plugin depending on
>> whether it's loaded by a GTK 3 or 4 application.
>
> Ah, thanks for the information. So that means at some point we should enable
> that in our build I guess.

Yep. Is it a problem if the package depends on both libgtk-3-0 and
libgtk-4-0 as well as libnma0 and libnma-gtk4-0? Or does that require a
separate package for the GTK 4 version? Or is there some metadata magic
that can make it work with GTK 3 and/or GTK 4 (at least one, but does
not require both)?

Technically, as I mentioned before, the main plugin
(libnm-vpn-plugin-strongswan.so), that's the one actually loaded by NM
or any other GUI, does not depend on libgtk or libnma. However,
depending on whether it was loaded by an application that uses GTK 3 or
GTK 4 (it uses dlsym() to search for a GTK3-only symbol), it then
dynamically loads either libnm-vpn-plugin-strongswan-editor.so or
libnm-gtk4-vpn-plugin-strongswan-editor.so via dlopen(), which are
linked against the corresponding libgtk/libnma. So I guess one could
argue that neither is a hard dependency for the package as the
application that loads the plugin must have such a dependency on either
version of these libraries anyway (at least libgtk, not sure about
libnma). So maybe those dependencies could also be omitted?

Regards,
Tobias

[Patrik Svestka]

Hi Tobias,

This is identical email I have sent you yesterday, but I noticed I have
send the mail only to you and not the tracker so I'm resending it so it
will be recorded also there.

----

Thank you for your reply. I see, now I understand the issue. Isn't
this issue of the packaging?

If it is loaded dynamically, how come that I got this error? I presume
the missing the gtk4 library version is the culprit.

How do I make sure that the package was build with `--with-gkt4`? I
have installed it via apt. Must I build my own custom package for
that?

Regards,

Patrik

On Thu, 2022-09-22 at 11:44 +0200, Tobias Brunner wrote:

[Harald Dunkel]

Hi folks,

I have to appologize for not checking my bug reports. There is no
excuse for that. I am very sorry.

I have applied Moritz' patch to the source repository on Salsa and
verified the GUI using Gnome on Bookworm. The error message is
gone now.

@Ian, if you have some spare minutes, would you mind to upload the
fixed version 1.6.0-2, if it looks OK to you? There are no source
code changes, just a modified configure command line and some
additional dependencies. Janitor made changes to the debian directory
on Salsa as well. Included.


Thank you very much

Harri

[Ian Jackson]

Harald Dunkel writes ("Re: Patch to build network-manager-strongswan against GTK 4, too"):

FTAOD you intend this for trixie ?

AFAICT from the mails on d-d-a I could upload now and it will be
processed "in due course".

Can you confirm the precise git commit hash you intend to release?

Thanks,
Ian.

--
Ian Jackson <ijac...@chiark.greenend.org.uk> These opinions are my own.

Pronouns: they/he. If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.

[Harald Dunkel]

Hi Ian,

this is intended as a bug fix for both Bookworm and Trixie. N-m-s is
severely restricted for Gnome desktop without this fix. There is no
newer upstream version yet.

The git commit is 9af28ccd2176633d95a3c15edee2518ce4e7e0c6 on
https://salsa.debian.org/debian/network-manager-strongswan, tagged
debian/1.6.0-2.

[Ian Jackson]

Harald Dunkel writes ("Re: Patch to build network-manager-strongswan against GTK 4, too"):

> this is intended as a bug fix for both Bookworm and Trixie. N-m-s is
> severely restricted for Gnome desktop without this fix. There is no
> newer upstream version yet.

OK, I will review it for trixie.

Would you check the stable release policy for the update to bookworm ?

[Ian Jackson]

Control: reassign -1 network-manager-strongswan
Control: forcemerge 1036607 -1

This bug is a duplicate of #1036607, which has been fixed in
unstable. We're also preparing an update to stable.