[Openvpn-users] 2.4.0 , address on tun inteface problem after reconnect to another server, linux

Hi,

Post by Dmitry Melekhov
Could you tell me is this expected behavior and, if yes, is there any
workaround , something like dhcp-release for windows?

This is a bug - on SIGUSR1 reconnect with --persist-tun, if options change
(like: "new IP address") these is wrongly ignored.

This is trac #812, and it was already fixed - to be released as part of
2.4.1 "soon" (in the coming weeks).

gert

--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany ***@greenie.muc.de
fax: +49-89-35655025 ***@net.informatik.tu-muenchen.de

Dmitry Melekhov

2017-01-26 07:10:01 UTC

Post by Dmitry Melekhov
Could you tell me is this expected behavior and, if yes, is there any
workaround , something like dhcp-release for windows?

This is a bug - on SIGUSR1 reconnect with --persist-tun, if options change
(like: "new IP address") these is wrongly ignored.
This is trac #812, and it was already fixed - to be released as part of
2.4.1 "soon" (in the coming weeks).
gert

Thank you!

I'll try to patch and rebuild 2.4.0.

Gert Doering

2017-01-26 07:49:42 UTC

Hi,

Post by Gert Doering
This is trac #812, and it was already fixed - to be released as part of
2.4.1 "soon" (in the coming weeks).

I'll try to patch and rebuild 2.4.0.

I've appended the patch below, for easier searching. Fairly trivial :-)

gert

From bf72ae68c05922c289056f2f851ed36014449cdf Mon Sep 17 00:00:00 2001
From: Selva Nair <***@gmail.com>
Date: Tue, 3 Jan 2017 16:42:18 -0500
Subject: [PATCH] Fix push options digest update

Trac: #812

Signed-off-by: Selva Nair <***@gmail.com>
Acked-by: Steffan Karger <***@fox-it.com>
Message-Id: <1483479738-17672-1-git-send-email-***@gmail.com>
URL: https://www.mail-archive.com/openvpn-***@lists.sourceforge.net/msg13816.html
Signed-off-by: Gert Doering <***@greenie.muc.de>
(cherry picked from commit a5dbf8c8dab23c47407c3f833c4f4aae52408af1)
---
src/openvpn/push.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index f5154756..c9c04a63 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -692,8 +692,8 @@ push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)
{
continue;
}
+ md_ctx_update(ctx, (const uint8_t *) line, strlen(line)+1);
}
- md_ctx_update(ctx, (const uint8_t *) line, strlen(line)+1);
}

int

--
2.11.0
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany ***@greenie.muc.de
fax: +49-89-35655025 ***@net.informatik.tu-muenchen.de

debbie10t

2017-01-26 11:31:52 UTC

Post by Dmitry Melekhov
Could you tell me is this expected behavior and, if yes, is there any
workaround , something like dhcp-release for windows?

This is a bug - on SIGUSR1 reconnect with --persist-tun, if options change
(like: "new IP address") these is wrongly ignored.
This is trac #812, and it was already fixed - to be released as part of
2.4.1 "soon" (in the coming weeks).
gert

Thank you!
I'll try to patch and rebuild 2.4.0.

Curiosity got me ..

Do you need --persist-* on your client ?

Or is it an option added by a config generator tool ?
EG: Network-manager

I would recommend reading the manual for each of the options your client
does use and deciding what is actually necessary.

Dmitry Melekhov

2017-01-26 11:55:20 UTC

Post by Dmitry Melekhov
Could you tell me is this expected behavior and, if yes, is there any
workaround , something like dhcp-release for windows?

This is a bug - on SIGUSR1 reconnect with --persist-tun, if options change
(like: "new IP address") these is wrongly ignored.
This is trac #812, and it was already fixed - to be released as part of
2.4.1 "soon" (in the coming weeks).
gert

Thank you!
I'll try to patch and rebuild 2.4.0.

Curiosity got me ..
Do you need --persist-* on your client ?

Really, no, there is no desperate need in it in this particular case :-)

On the other hand , there is no contra, at least I don't see any...

Post by debbie10t
Or is it an option added by a config generator tool ?
EG: Network-manager
I would recommend reading the manual for each of the options your client
does use and deciding what is actually necessary.

Thank you for hint, I run openvpn since 2005 and never thought about
reading manual ;-)

debbie10t

2017-01-26 12:43:37 UTC

Post by Dmitry Melekhov
Could you tell me is this expected behavior and, if yes, is there any
workaround , something like dhcp-release for windows?

This is a bug - on SIGUSR1 reconnect with --persist-tun, if options change
(like: "new IP address") these is wrongly ignored.
This is trac #812, and it was already fixed - to be released as part of
2.4.1 "soon" (in the coming weeks).
gert

Thank you!
I'll try to patch and rebuild 2.4.0.

Curiosity got me ..
Do you need --persist-* on your client ?

Really, no, there is no desperate need in it in this particular case :-)
On the other hand , there is no contra, at least I don't see any...

Other than the problem you are currently experiencing ..

--persist-* is necessary if you are dropping privileges.
(I am not aware of any other reason)

Thank you for hint, I run openvpn since 2005 and never thought about
reading manual ;-)

I presume you are ribbing me ;-)

OTOH, you would not be the first to march blindly into the fray !

It might be interesting to know the difference in hits between
the official docs and, for example, a wordpress or Pi tutorial ..

Regards

Dmitry Melekhov

2017-01-26 13:06:10 UTC

Post by Dmitry Melekhov
Could you tell me is this expected behavior and, if yes, is there any
workaround , something like dhcp-release for windows?

This is a bug - on SIGUSR1 reconnect with --persist-tun, if options change
(like: "new IP address") these is wrongly ignored.
This is trac #812, and it was already fixed - to be released as part of
2.4.1 "soon" (in the coming weeks).
gert

Thank you!
I'll try to patch and rebuild 2.4.0.

Curiosity got me ..
Do you need --persist-* on your client ?

Really, no, there is no desperate need in it in this particular case :-)
On the other hand , there is no contra, at least I don't see any...

Other than the problem you are currently experiencing ..
--persist-* is necessary if you are dropping privileges.
(I am not aware of any other reason)

And? Any reasons I can't drop privileges on server which provides
LAN-to-LAN link, although it acts as openvpn client?
And yes, I can not use it, because it is not server, so it has less
security problems.
So situation is absolutely as I wrote before- no desperate need.