networkmanager: Show error when connecting without stored password

When connecting to a Wi-Fi network with a saved connection but no stored
password (no `psk=` in `.nmconnection` file), the Networking page did
not show any error or other visible status change.

Sadly, the NetworkManager API does not make this easy: It transitions
through device states (via  D-Bus signals) very quickly (PREPARE →
CONFIG → NEED_AUTH → FAILED → DISCONNECTED), and React batches all these
property updates together. By the time the `useEffect` runs, the device
has already returned to DISCONNECTED state and the interesting failure
reason (NM_DEVICE_STATE_REASON_NO_SECRETS) already was reset and the
state is just NM_DEVICE_STATE_DISCONNECTED.

Fix this by capturing the failure reason in the D-Bus signal handler and
storing it on the device object. The UI can then retrieve and consume
this cached reason when checking for failures.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: martinpitt

pkg/networkmanager/interfaces.js

@@ -17,7 +17,7 @@ import { show_modal_dialog } from "cockpit-components-dialog.jsx";
 
 const _ = cockpit.gettext;
 
-function show_error_dialog(title, message) {
+export function show_error_dialog(title, message) {
     const props = {
         id: "error-popup",
         title,
@@ -332,7 +332,8 @@ export function NetworkManagerModel() {
 
             if (signal == "PropertiesChanged") {
                 push_refresh();
-                set_object_properties(obj, remove_signatures(args[0]));
+                const props = remove_signatures(args[0]);
+                set_object_properties(obj, props);
                 pop_refresh();
             } else if (type.signals && type.signals[signal])
                 type.signals[signal](obj, args);
@@ -399,6 +400,21 @@ export function NetworkManagerModel() {
             Object.keys(interfaces).forEach(iface => {
                 const props = interfaces[iface];
 
+                /* Capture connection failure reasons for devices
+                   NM transitions through PREPARE → CONFIG → NEED_AUTH → FAILED → DISCONNECTED very
+                   quickly, and React batches these updates, so the UI often misses the FAILED state.
+                   Store the failure reason here at the D-Bus event level so we can retrieve it later. */
+                if (path.includes("/Devices/") && props?.StateReason) {
+                    const obj = peek_object(path);
+                    if (obj) {
+                        const [state, reason] = props.StateReason;
+                        if (state === 120 && reason !== 0) {
+                            utils.debug("Captured", obj.Interface, "failure, reason:", reason);
+                            priv(obj).lastFailureReason = reason;
+                        }
+                    }
+                }
+
                 if (props)
                     interface_properties(path, iface, props);
                 else
@@ -1150,6 +1166,7 @@ export function NetworkManagerModel() {
             Interface: { },
             StateText: { prop: "State", conv: device_state_to_text, def: _("Unknown") },
             State: { },
+            StateReason: { def: [0, 0] }, // [state, reason] tuple
             HwAddress: { },
             AvailableConnections: { conv: conv_Array(conv_Object(type_Connection)), def: [] },
             ActiveConnection: { conv: conv_Object(type_ActiveConnection) },
@@ -1170,13 +1187,15 @@ export function NetworkManagerModel() {
 
         prototype: {
             activate: function(connection, specific_object) {
+                priv(this).lastFailureReason = undefined; // Clear stale failure reason from previous attempts
                 return call_object_method(get_object("/org/freedesktop/NetworkManager", type_Manager),
                                           "org.freedesktop.NetworkManager", "ActivateConnection",
                                           objpath(connection), objpath(this), objpath(specific_object))
                         .then(([active_connection]) => active_connection);
             },
 
             activate_with_settings: function(settings, specific_object) {
+                priv(this).lastFailureReason = undefined; // Clear stale failure reason from previous attempts
                 try {
                     return call_object_method(get_object("/org/freedesktop/NetworkManager", type_Manager),
                                               "org.freedesktop.NetworkManager", "AddAndActivateConnection",
@@ -1203,6 +1222,13 @@ export function NetworkManagerModel() {
                             // RequestScan can fail if a scan was recently done, that's OK
                             console.warn("request_scan: scan failed for", this.Interface + ":", error.toString());
                         });
+            },
+
+            // Get and clear the last connection failure reason
+            consume_failure_reason: function() {
+                const reason = priv(this).lastFailureReason;
+                priv(this).lastFailureReason = undefined;
+                return reason;
             }
         },
 

pkg/networkmanager/network-interface.jsx

@@ -60,6 +60,7 @@ import {
     is_managed,
     render_active_connection,
     settings_applier,
+    show_error_dialog,
     show_unexpected_error,
     syn_click,
     with_checkpoint,
@@ -274,6 +275,7 @@ export const NetworkInterfacePage = ({
     const [isScanning, setIsScanning] = useState(false);
     const [prevAPCount, setPrevAPCount] = useState(0);
     const [networkSearch, setNetworkSearch] = useState("");
+    const [pendingConnection, setPendingConnection] = useState(null); // ssid
 
     const dev_name = iface.Name;
     const dev = iface.Device;
@@ -291,6 +293,33 @@ export const NetworkInterfacePage = ({
         }
     });
 
+    // Monitor device state to detect connection success/failure
+    useEffect(() => {
+        if (!dev || !pendingConnection)
+            return;
+
+        // Successfully connected
+        if (dev.ActiveAccessPoint?.Ssid === pendingConnection && dev.State === 100) { // NM_DEVICE_STATE_ACTIVATED
+            setPendingConnection(null);
+            return;
+        }
+
+        // Check for failure - if there's a captured failure reason, the connection attempt failed
+        if (dev.State === 30 && !dev.ActiveConnection) { // NM_DEVICE_STATE_DISCONNECTED
+            const failureReason = dev.consume_failure_reason();
+            if (failureReason !== undefined) {
+                utils.debug("Connection to", pendingConnection, "failed with captured reason:", failureReason);
+                show_error_dialog(
+                    cockpit.format(_("Failed to connect to $0"), pendingConnection),
+                    failureReason === 7 // NM_DEVICE_STATE_REASON_NO_SECRETS
+                        ? _("Network password is not stored. Please forget and reconnect to this network.")
+                        : _("Connection failed. Check your credentials.")
+                );
+                setPendingConnection(null);
+            }
+        }
+    }, [dev, dev?.State, dev?.StateReason, dev?.ActiveConnection, dev?.ActiveAccessPoint?.Ssid, pendingConnection]);
+
     // WiFi scanning: re-enable button when APs change or after timeout
     useEffect(() => {
         if (isScanning) {
@@ -861,9 +890,13 @@ export const NetworkInterfacePage = ({
             if (ap.Connection) {
                 // Activate existing connection (which already has password if needed)
                 utils.debug("Activating existing connection for", ap.Ssid);
+                setPendingConnection(ap.Ssid);
                 ap.Connection.activate(dev, ap)
-                        .then(() => utils.debug("Connected successfully to", ap.Ssid))
-                        .catch(show_unexpected_error);
+                        .then(() => utils.debug("Connection activation started for", ap.Ssid))
+                        .catch(error => {
+                            setPendingConnection(null);
+                            show_unexpected_error(error);
+                        });
                 return;
             }
 

test/verify/check-networkmanager-wifi

@@ -226,6 +226,33 @@ wpa_passphrase=hidden99""")
         # OpenNet is known but not connected
         b.wait_visible("tr[data-ssid='OpenNet'] .nm-icon-known")
 
+        # Test connection failure when password is not stored
+        # Disconnect first
+        b.click("tr[data-ssid='ZE WIFI!'] button[aria-label='Disconnect']")
+        b.wait_visible("tr[data-ssid='ZE WIFI!'] button[aria-label='Connect']")
+        # Remove the password from the connection file and restart NM
+        m.execute("sed -i '/^psk=/d' /etc/NetworkManager/system-connections/'ZE WIFI!.nmconnection'")
+        m.execute("systemctl restart NetworkManager")
+        b.reload()
+        b.enter_page("/network")
+        # Try to connect - shows error about missing password
+        b.click("tr[data-ssid='ZE WIFI!'] button[aria-label='Connect']")
+        b.wait_in_text("#error-popup", "Failed to connect to ZE WIFI!")
+        b.wait_in_text("#error-popup", "Network password is not stored")
+        b.click("#error-popup button:contains('Close')")
+        b.wait_not_present("#error-popup")
+        # Restore the connection with password for subsequent tests
+        b.click("tr[data-ssid='ZE WIFI!'] button.pf-v6-c-menu-toggle")
+        b.click(".pf-v6-c-menu button[aria-label='Forget']")
+        b.wait_not_present("tr[data-ssid='ZE WIFI!'] .nm-icon-known")
+        b.click("tr[data-ssid='ZE WIFI!'] button[aria-label='Connect']")
+        b.wait_in_text("#network-wifi-connect-dialog", "Connect to ZE WIFI!")
+        b.set_input_text("#network-wifi-connect-password-input", "12345678")
+        b.click("#network-wifi-connect-connect")
+        b.wait_not_present("#network-wifi-connect-dialog")
+        b.wait_visible("tr[data-ssid='ZE WIFI!'] button[aria-label='Disconnect']")
+        b.wait_visible("tr[data-ssid='ZE WIFI!'] .nm-icon-connected")
+
         # connecting to OpenNet disconnects from ZE WIFI!
         self.assertIn("ZE WIFI!", m.execute("nmcli d show wlan1 | grep GENERAL.CONNECTION"))
         b.click("tr[data-ssid='OpenNet'] button[aria-label='Connect']")