Network Manager 0.7, openvpn, VPN Connection Failed

Part #2 of bug #259562 is a dup of this one, so I'm marking as confirmed and merging them.

Tore

milestoning to get the server team (who maintains openvpn) on this plate.

Apparently the openvpn upgrade to 2.1~rc7 broke the script-security thing.

Anyone can take a look?

(see bug #259562)

ok, zul confirmed that this is a openvpn issue (not a nm plugin one). next openvpn upload is supposed to fix this. closing nm part accordingly.

This bug was fixed in the package openvpn - 2.1~rc9-3ubuntu1

---------------
openvpn (2.1~rc9-3ubuntu1) intrepid; urgency=low

  * debian/openvpn.init.d: Add "--script-security 2" by default for backwards compatibility
    (LP: #260291)

 -- Chuck Short <email address hidden> Mon, 25 Aug 2008 10:20:31 -0400

looks like the nm plugin needs a fix on its own. Thanks to M. Biebl for providing that patch.

diff --git a/openvpn/src/nm-openvpn-service.c b/vpn-daemons/openvpn/src/nm-openvpn-service.c
index 9d0c7d4..0df1178 100644
--- a/openvpn/src/nm-openvpn-service.c
+++ b/openvpn/src/nm-openvpn-service.c
@@ -611,6 +611,10 @@ nm_openvpn_start_openvpn_binary (NMOpenvpnPlugin *plugin,
  add_openvpn_arg (args, "--syslog");
  add_openvpn_arg (args, "nm-openvpn");

+ // Override external script protection
+ add_openvpn_arg (args, "--script-security");
+ add_openvpn_arg (args, "2");
+
  /* Up script, called when connection has been established or has been restarted */
  add_openvpn_arg (args, "--up");
  add_openvpn_arg (args, NM_OPENVPN_HELPER_PATH);

You're right about that, at least it still doesn't work after the upgrade to openvpn 2.1~rc9-3ubuntu1. Still fails with the script-security error message.

Tore

Hi,

Applying the pacth seem to fix the connection problem.

Here is the log :

Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXsmpServer: accept_ice_connection()
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Setting up new connection
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: New client '0x91c3ca0 []'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmStore: Adding object id /org/gnome/SessionManager/Client14 to store
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmManager: Client added: /org/gnome/SessionManager/Client14
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Initializing client 0x91c3ca0 []
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Client '0x91c3ca0 []' received RegisterClient(10ab341c573b3a0b42121999669372969000000053580016)
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmManager: Adding new client 10ab341c573b3a0b42121999669372969000000053580016 to session
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Sending RegisterClientReply to '0x91c3ca0 [10ab341c573b3a0b42121999669372969000000053580016]'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Set properties from client '0x91c3ca0 [10ab341c573b3a0b42121999669372969000000053580016]'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: CurrentDirectory = '/home/bigbob'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Set properties from client '0x91c3ca0 [10ab341c573b3a0b42121999669372969000000053580016]'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: ProcessID = '19160'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Set properties from client '0x91c3ca0 [10ab341c573b3a0b42121999669372969000000053580016]'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Program = 'nm-openvpn-auth-dialog'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Set properties from client '0x91c3ca0 [nm-openvpn-auth-dialog 10ab341c573b3a0b42121999669372969000000053580016]'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: CloneCommand = 'nm-openvpn-auth-dialog'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Set properties from client '0x91c3ca0 [nm-openvpn-auth-dialog 10ab341c573b3a0b42121999669372969000000053580016]'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: RestartCommand = 'nm-openvpn-auth-dialog' '--sm-client-id' '10ab341c573b3a0b42121999669372969000000053580016' '--screen' '0'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: Set properties from client '0x91c3ca0 [nm-openvpn-auth-dialog 10ab341c573b3a0b42121999669372969000000053580016]'
Aug 29 10:24:36 bigbob-virtual x-session-manager[5358]: DEBUG(+): GsmXSMPClient: UserID = 'bigbob'
Aug 29 10:24:36 bigbob-virt...

More Information (in German):

http://amor.cms.hu-berlin.de/~herenzed/blog/archives/2008/08/29/openvpn_an_der_hu-berlin_update/index.html

I can confirm that the patch posted by Alexander Sack fixes the issue.

Today's updates fixed the issue

2008-09-10 openvpn update fixed the issue, but after that came another update and openvpn is broken again.

Sep 12 10:42:51 ubuntu NetworkManager: <info> Starting VPN service 'org.freedesktop.NetworkManager.openvpn'...
Sep 12 10:42:51 ubuntu NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 10127
Sep 12 10:42:52 ubuntu NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.openvpn' just appeared, activating connections
Sep 12 10:42:52 ubuntu NetworkManager: <info> VPN plugin state changed: 3
Sep 12 10:42:52 ubuntu NetworkManager: <info> VPN connection 'Siemens' (Connect) reply received.
Sep 12 10:42:52 ubuntu NetworkManager: <WARN> nm_vpn_connection_connect_cb(): VPN connection 'Siemens' failed to connect: 'No VPN configuration options.'.
Sep 12 10:43:04 ubuntu NetworkManager: <debug> [1221205384.024893] ensure_killed(): waiting for vpn service pid 10127 to exit
Sep 12 10:43:04 ubuntu NetworkManager: <debug> [1221205384.025178] ensure_killed(): vpn service pid 10127 cleaned up

After earlier update network-manager-openvpn will not connect. Worked great until the update on the 12th, then it was broken. Output of /var/log/syslog:

Sep 16 23:52:19 will-laptop NetworkManager: <info> Starting VPN service 'org.freedesktop.NetworkManager.openvpn'...
Sep 16 23:52:19 will-laptop NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 7363
Sep 16 23:52:19 will-laptop NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.openvpn' just appeared, activating connections
Sep 16 23:52:19 will-laptop NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.openvpn' just appeared, activating connections
Sep 16 23:52:19 will-laptop NetworkManager: nm_vpn_connection_activate: assertion `nm_vpn_connection_get_vpn_state (connection) == NM_VPN_CONNECTION_STATE_PREPARE' failed
Sep 16 23:52:19 will-laptop NetworkManager: <info> VPN plugin state changed: 1
Sep 16 23:52:19 will-laptop NetworkManager: <info> VPN plugin state changed: 3
Sep 16 23:52:19 will-laptop nm-openvpn[7367]: Options error: Unrecognized option or missing parameter(s) in [CMD-LINE]:1: script-security (2.1_rc7)
Sep 16 23:52:19 will-laptop nm-openvpn[7367]: Use --help for more information.
Sep 16 23:52:19 will-laptop NetworkManager: <info> VPN connection '<name of my VPN>' (Connect) reply received.
Sep 16 23:52:19 will-laptop NetworkManager: <info> VPN plugin state changed: 6
Sep 16 23:52:19 will-laptop NetworkManager: <WARN> connection_state_changed(): Could not process the request because no VPN connection was active.
Sep 16 23:52:31 will-laptop NetworkManager: <debug> [1221630751.971864] ensure_killed(): waiting for vpn service pid 7363 to exit
Sep 16 23:52:31 will-laptop NetworkManager: <debug> [1221630751.972027] ensure_killed(): vpn service pid 7363 cleaned up

WillSmith: you should update openvpn to the latest version as well. network-manager-openvpn depends on "openvpn" while it should now depend on openvpn (>= 2.1~rc9), the one that supports the now-required --script-security option.

Erki: could you please open a separate bug ? the two issues don't seem to be connected. Just confirm between which versions it appeared and give more information on the "Siemens" configuration that seems to have no options. Thanks.

Hi,
I discovered that my problem was indeed different. While experimenting with various settings, I had accidentally left "System setting" as checked. When clearing that checkmark, my connection starts working.

Why does this affect the connection? If I understood correctly, this means that by checking "System setting", the connection should by made without user login. But when I'm actually logged in, the connection should still be possible irrelevant of this setting?

erki

Thierry:
I updated openvpn to the rc9. The first try it did the same thing as before. But now it works. So, updating to openvpn 2.1~rc9 seems to fix the issue.

The same problem (openvpn_execve: external program may not be called due to setting of --script-security level)
in openvpn version 2.1~rc11-1ubuntu2.
So it seems the problem returns...

Still works for me.

Tore

Indeed, my mistake. I've ran it with --script-security 2 option and everything is OK.
Apologizing for providing a wrong info.

I'm still having the problem that Erki Hallingu and WillSmith reported.

Nov 1 16:40:05 valentin-laptop NetworkManager: <info> Starting VPN service 'org.freedesktop.NetworkManager.openvpn'...
Nov 1 16:40:05 valentin-laptop NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 10955
Nov 1 16:40:05 valentin-laptop NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.openvpn' just appeared, activating connections
Nov 1 16:40:05 valentin-laptop NetworkManager: <info> VPN plugin state changed: 1
Nov 1 16:40:05 valentin-laptop NetworkManager: <info> VPN plugin state changed: 3
Nov 1 16:40:05 valentin-laptop NetworkManager: <info> VPN connection 'VPN Connection Name' (Connect) reply received.
Nov 1 16:40:05 valentin-laptop NetworkManager: <WARN> nm_vpn_connection_connect_cb(): VPN connection 'VPN Connection Name' failed to connect: 'No VPN configuration options.'.
Nov 1 16:40:05 valentin-laptop NetworkManager: <WARN> connection_state_changed(): Could not process the request because no VPN connection was active.
Nov 1 16:40:05 valentin-laptop NetworkManager: <info> (eth1): writing resolv.conf to /sbin/resolvconf
Nov 1 16:40:05 valentin-laptop NetworkManager: <info> Policy set 'Auto AP' (eth1) as default for routing and DNS.

openvpn 2.1~rc11-1ubuntu2 on Intrepid.

I can confirm this bug. When i start a openvpn-connection with the network manager, the connection seems to be okay. But when i ping some hosts (by hostname) something seems to be wrong. I have attached the syslog output. In my openvpn configuration i use some resolv-scripts:

up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

It seems to be a special resolver problem. When i start the openvpn connection manually everything i okay:

# sudo openvpn --script-security 2 --config ./vpn/office.conf