5

I just updated from ubuntu 19.10 to ubuntu 20.04. Now my resolve.conf does not get updated anymore when I connect to vpn with the openconnect thing in the network manager.

This works correctly:

sudo openconnect -u user https://server

I see the resolv.conf being changed. So it's a client problem.

in /etc/NetworkManager/NetworkManager.conf I have dns=none to use the resolv.conf

/etc/resolv.conf is a file and is not symlinked to /run/systemd/resolve/resolv.conf. I did check if /run/systemd/resolve/resolv.conf was being updated by anything, but this also does not get updated.

This is from syslog:

NetworkManager[62862]: <info>  [1590658767.3686] vpn-connection[,"vpn",0]: VPN connection: (ConnectInteractive) reply received
NetworkManager[62862]: <info>  [1590658767.3714] vpn-connection[,"vpn",0]: VPN plugin: state changed: starting (3)
openconnect[63139]: Connected to somehostip:443
openconnect[63139]: SSL negotiation with somehostip
openconnect[63139]: Server certificate verify failed: signer not found
openconnect[63139]: Connected to HTTPS on somehostip 
openconnect[63139]: Got CONNECT response: HTTP/1.1 200 OK
openconnect[63139]: CSTP connected. DPD 30, Keepalive 20
openconnect[63139]: Connected as 10.0.0.2 + ipv6addresswashere, using SSL, with DTLS in progress
openconnect[63139]: Established DTLS connection (using GnuTLS). Ciphersuite (DTLS0.9)-(DHE-CUSTOM)-(AES-256-CBC)-(SHA1).
openconnect[63139]: SIOCSIFMTU: Operation not permitted
NetworkManager[62862]: <info>  [1590658768.5289] vpn-connection[,"vpn",0]: VPN connection: (IP Config Get) reply received.
NetworkManager[62862]: <info>  [1590658768.5320] vpn-connection[,"vpn",14:(vpn0)]: VPN connection: (IP4 Config Get) reply received
NetworkManager[62862]: <info>  [1590658768.5362] vpn-connection[,"vpn",14:(vpn0)]: VPN connection: (IP6 Config Get) reply received
NetworkManager[62862]: <info>  [1590658768.5373] vpn-connection[,"vpn",14:(vpn0)]: Data: VPN Gateway: somehostip
NetworkManager[62862]: <info>  [1590658768.5374] vpn-connection[,"vpn",14:(vpn0)]: Data: Tunnel Device: "vpn0"
NetworkManager[62862]: <info>  [1590658768.5374] vpn-connection[,"vpn",14:(vpn0)]: Data: IPv4 configuration:
NetworkManager[62862]: <info>  [1590658768.5375] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Address: 10.0.0.2
NetworkManager[62862]: <info>  [1590658768.5375] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Prefix: 19
NetworkManager[62862]: <info>  [1590658768.5375] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Point-to-Point Address: 10.0.0.55
NetworkManager[62862]: <info>  [1590658768.5375] vpn-connection[,"vpn",14:(vpn0)]: Data:   Static Route: 0.0.0.0/0   Next Hop: 0.0.0.0
NetworkManager[62862]: <info>  [1590658768.5376] vpn-connection[,"vpn",14:(vpn0)]: Data:   Static Route: 10.0.0.0/19   Next Hop: 0.0.0.0
NetworkManager[62862]: <info>  [1590658768.5376] vpn-connection[,"vpn",14:(vpn0)]: Data:   DNS Domain: 'xxx.com'  
NetworkManager[62862]: <info>  [1590658768.5376] vpn-connection[,"vpn",14:(vpn0)]: Data: IPv6 configuration:
NetworkManager[62862]: <info>  [1590658768.5377] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Address: ipv6addresswashere
NetworkManager[62862]: <info>  [1590658768.5377] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Prefix: 64
NetworkManager[62862]: <info>  [1590658768.5378] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Point-to-Point Address: ipv6addresswashere
NetworkManager[62862]: <info>  [1590658768.5378] vpn-connection[,"vpn",14:(vpn0)]: Data:   Static Route: ::/0   Next Hop: ::
NetworkManager[62862]: <info>  [1590658768.5378] vpn-connection[,"vpn",14:(vpn0)]: Data:   Static Route: ipv6addresswashere   Next Hop: ::
NetworkManager[62862]: <info>  [1590658768.5378] vpn-connection[,"vpn",14:(vpn0)]: Data:   DNS Domain: 'xxx.com'  
NetworkManager[62862]: <info>  [1590658768.5380] vpn-connection[,"vpn",14:(vpn0)]: VPN plugin: state changed: started (4)
NetworkManager[62862]: <info>  [1590658768.5534] vpn-connection[,"vpn",14:(vpn0)]: VPN connection: (IP Config Get) complete
NetworkManager[62862]: <info>  [1590658768.5548] device (vpn0): state change: unmanaged -> unavailable (reason 'connection-assumed', sys-iface-state: 'external')
NetworkManager[62862]: <info>  [1590658768.5600] device (vpn0): state change: unavailable -> disconnected (reason 'connection-assumed', sys-iface-state: 'external')
NetworkManager[62862]: <info>  [1590658768.5615] device (vpn0): Activation: starting connection 'vpn0' (xxx)
NetworkManager[62862]: <info>  [1590658768.5616] manager: NetworkManager state is now CONNECTED_SITE
NetworkManager[62862]: <info>  [1590658768.5629] manager: NetworkManager state is now CONNECTED_LOCAL 
NetworkManager[62862]: <info>  [1590658768.5632] manager: NetworkManager state is now CONNECTED_SITE
NetworkManager[62862]: <info>  [1590658768.5633] policy: set 'vpn' (vpn0) as default for IPv4 routing and DNS

I looked in an older syslog from before the upgrade and there are lines in there like:

NetworkManager[1245]: <info>  [1590386910.5867] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal DNS: 10.0.0.1
NetworkManager[1245]: <info>  [1590386910.5867] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal DNS: 10.0.0.2

So those are missing now. Anyone got a clue on how to fix this?

I did try it with dns=auto to use systemd-resolve but that has the same problem. systemd-resolve --status reports no dns servers for the vpn connection, as well as on /run/systemd/resolve/resolv.conf.

Note: I anonymized all ip addresses and host names etc.

Improve this question
3
  • When I use openconnect with systemd-resolve, I don't hit the correct DNS server. My resolve.conf is symlinked though. systemd-resolve seems to make its own "server" at some 127.0.0.X address at least that is what I have been assuming. Hoping someone comes by and has a fix soon.
    – David Stocking
    May 28, 2020 at 16:38
  • I am no specialist but I don't think systemd-resolve creates it's own server. I think you might be running something like dnsmasq (I think this was the standard in 16.04?). systemd-resolve creates the /run/systemd/resolve/resolv.conf file and /etc/resolv.conf is symlinked to that one. You can get some information with systemd-resolve --status. systemd-resolve also allows you to make changes to the config file.
    – Veda
    May 29, 2020 at 18:48
  • I will look into that IDK what it is doing. I am using Pop OS 20.04. I guess I am just going to keep plugging away at figuring out what it does.
    – David Stocking
    May 30, 2020 at 20:07

1 Answer 1

Reset to default
5

I found the solution. Basically, if the dns server sents ipv6 dns servers to lookup ipv4 addresses things go wrong. Openconnect will put ipv6 addresses in INTERNAL_IP4_DNS and the "network-manager-openconnect" does not expect that, treats the whole variable (and basically all dns servers) as garbage and goes on. I compiled my own network-manager-openconnect from master which has a fix for this, and that works fine.

I don't know why I have this problem after upgrading. Maybe something changed in openconnect? Or maybe in the day I upgraded my company network admin added an ipv6 dns server? (I think that is unlikely...)

If you are using network-manager-openconnect 1.2.6 or 1.2.7-dev (or maybe even a lower version, which does not contain the fix) you can compile your own version from master like so:

sudo apt-get build-dep network-manager-openconnect
mkdir ~/network-manager-openconnect_build
cd ~/network-manager-openconnect_build
git clone https://gitlab.gnome.org/GNOME/NetworkManager-openconnect.git
cd NetworkManager-openconnect
./autogen.sh
make
sudo mv /usr/lib/NetworkManager/nm-openconnect-service-openconnect-helper /usr/lib/NetworkManager/nm-openconnect-service-openconnect-helper_bak
sudo cp src/nm-openconnect-service-openconnect-helper /usr/lib/NetworkManager/nm-openconnect-service-openconnect-helper

Note: I only copied over the helper bin. In theory this could give incompatibility problems. I had no problems with it. But if you have, you might try to copy over the main bin as wel from src.

If you want, you can use the following to have extra logging for the vpn module to see in the syslog if openconnect received any dns data:

sudo nmcli general logging level KEEP domains VPN_PLUGIN:TRACE

If you see the INTERNAL_IP4_DNS being set with both ipv4 and ipv6 addresses, and you use the openconnect network manager version mentioned above, you are affected with this bug.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .