strongSwan

I am asked for the key passphrase, but it seems that it is lost on its way to charon-nm.

It's not actually lost. What happens is this: The NeedSecrets callback is called multiple times by NetworkManager. If the method returns TRUE NM will invoke the registered auth-dialog. The first time without interaction, to load cached secrets, the second time with interaction, to show a dialog and request a secret from the user. The problem is that the NeedSecret implementation in source:src/charon-nm/nm/nm_service.c#L623 always will return TRUE for public key authentication ("key"). This is because the entered password is not yet made available to the decoding routines. After this happens the second time NM's internal state machine breaks because it does not expect additional secrets to be required after the user has already been asked for one. I'm not sure why it worked before. It's possible that earlier versions of NM called NeedSecrets just once.

Something like this should fix it:

--- a/src/charon-nm/nm/nm_service.c
+++ b/src/charon-nm/nm/nm_service.c
@@ -660,6 +660,10 @@ static gboolean need_secrets(NMVPNPlugin *plugin, NMConnection *connection,
                                        key->destroy(key);
                                        return FALSE;
                                }
+                               else if (nm_setting_vpn_get_secret(settings, "password"))
+                               {
+                                       return FALSE;
+                               }
                        }
                }
                else if (streq(method, "smartcard"))

I tried your patch on top of 5.1.2, but it seems that the key still cannot be decoded. Log file is attached. Please note the "no private key found for ...". If I use the key without passphrase, then there is no such message.

Do you think this is something to be fixed in NetworkManager or network-manager-strongswan?

Do you think your patch could be added to the official sources?

Done with the associated commit.