headers
Justin | 1 May 2013 15:27
Picon
Favicon
Gravatar

vpnc doesn't work with libgcrypt build with caps support

Hello,

I would like to forward to you a bug report I received
(https://bugs.gentoo.org/show_bug.cgi?id=467744):

Problem:

net-misc/vpnc-0.5.3_p527 doesn't connect to server with
dev-libs/libgcrypt-1.5.2[caps] (the "caps" USE flag was added yesterday,
by the way):

----
# vpnc /etc/vpnc/vpnc.conf --debug 3

vpnc version 0.5.3
   hex_test: 00010203

S1 init_sockaddr
 [2013-04-28 21:41:02]

S2 make_socket
 [2013-04-28 21:41:03]
vpnc: Error binding to source port. Try '--local-port 0'
Failed to bind to 0.0.0.0:500: Permission denied

## Try an unprivileged port
# vpnc /etc/vpnc/vpnc.conf --debug 3 --local-port 10942

vpnc version 0.5.3
   hex_test: 00010203
(Continue reading)

Permalink | Reply | 4 comments |
headers
Darin McBride | 22 Apr 2013 18:15
Picon
Favicon

VPNC no longer connecting?

Yesterday, vpnc connected to my office.  Today, it doesn't.  And, of course, 
$work doesn't want to support me at all for reasons I can never quite 
understand.

I'm hoping someone here will have some sort of idea what's going on, as I can 
no longer do any work.

The end of the --debug 98 looks like this:

   PARSING PAYLOAD type: 00 (ISAKMP_PAYLOAD_NONE)
   PARSE_OK
   got ike lifetime attributes: 2147483 seconds
   IKE SA selected psk+xauth-3des-sha1
   unknown ISAKMP_PAYLOAD_VID: 12f5f28c 457168a9 702d9fe2 74cc0100
   peer is XAUTH capable (draft-ietf-ipsec-isakmp-xauth-06)
   ignoring that peer is DPD capable (RFC3706)
   peer is NAT-T capable (RFC 3947)
   peer is using type 20 (ISAKMP_PAYLOAD_NAT_D) for NAT-Discovery payloads
   peer is using type 20 (ISAKMP_PAYLOAD_NAT_D) for NAT-Discovery payloads
   unknown ISAKMP_PAYLOAD_VID:
   4048b7d5 6ebce885 25e7de7f 00d6c2d3 c0000000
   unknown ISAKMP_PAYLOAD_VID: 1f07f70e aa6514d3 b0fa9654 2a500100
   dh_shared_secret:
   a786d3c9 5f2f9f1d e0b5ad9e e8ab8a33 ae6e76c0 ef2641c5 6c3017f7 48c7c175
   854234cf 36f787f8 cf263861 439936de 9818c6bd 925a9705 ddd20c8c 1cb228b4
   38fc8384 33cc4711 270ac52f 3a6e01fe 8faee0c3 78e86417 9d9e712a 34035477
   49b2fb9e aa6cf44f 3ab2a8ee ab1777e5 d04a85f7 131bd903 f9df9039 db6044a4
   (not dumping psk hash)
   skeyid:
   15b19e60 a49a3009 1326c816 739aa71d 562218a4
(Continue reading)

Permalink | Reply | 0 comments |
headers
Tobia Conforto | 4 Apr 2013 19:47
Picon
Favicon

Timeout issue (rekeying?)

I'm having a timeout issue: after 30m vpnc dies with message "vpnc: no
response from target". The lifetime advertised by the server is 8h.

Here is an abridged version of the log:

VPNC started in foreground
(it works for exactly 30m, then:)
S7.1 QM_packet1
S7.2 QM_packet2 send_receive
S7.3 QM_packet2 validate type
vpnc: no response from target

Full --debug 3 is available here:
http://www.gruppo4.com/~tobia/vpnc_vr_3.log

Many thanks to whomever will help me figure out what the problem might be.

Best regards,
Tobia
Permalink | Reply | 0 comments |
headers
Tobia Conforto | 4 Apr 2013 18:29
Picon
Favicon

Stable release issue

Hello

I'm writing to raise an issue that is probably of low interest to vpnc
developers, but is of some relevance to the user base at large.

Recently I was having a problem with the dead peer detection firing at
random. After some googling I found Mihai's post from 2010 [1]. I
cursed the ancient Debian package and went off to recompile vpnc from
the latest sources.

I did so, downloading the latest tarball from the website, only to
discover (hours later) that it *still* didn't include that fix from
2010.

Now, I have no problem building from svn, (that's what I did, at last)
but I think it's misleading to offer "stable" releases for download on
the project's website without either 1) a maintainer that periodically
releases them, or 2) a notice that users are advised to checkout from
svn.

So, in the absence of 1), I would suggest that somebody who has access
to the website adds a notice to direct users (and distribution
packagers) to use the latest commit. I believe this would save a
non-trivial amount of collective time and headaches (and mailing list
noise.)

Thanks,
Tobia

[1] http://lists.unix-ag.uni-kl.de/pipermail/vpnc-devel/2010-December/003492.html
(Continue reading)

Permalink | Reply | 0 comments |
headers
Alon Bar-Lev | 15 Mar 2013 22:13
Picon
Gravatar

[PATCH 0/4] Unprivileged daemon

1. Allow overriding utilities.
2. Allow overriding rootfs location.
3. Handle tun interface cleanup when disconnect.
4. Support route and dns metrics.

This patch is against vpnc-scripts repository.
It is a resent as was not applied.

Alon Bar-Lev (4):
  allow overriding utilities and /var/run location
  delete tun address on disconnect
  always run the vpnc-script at exit
  support password program

 config.c        |  17 +++++-
 config.h        |   1 +
 tunip.c         |   2 +-
 tunip.h         |   1 +
 vpnc-disconnect |   3 +-
 vpnc-script     |  42 +++++++++++----
 vpnc.c          | 165 ++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 vpnc.h          |   2 +
 8 files changed, 215 insertions(+), 18 deletions(-)

--

-- 
1.8.1.5
Permalink | Reply | 5 comments |
headers
Alon Bar-Lev | 15 Mar 2013 22:11
Picon
Gravatar

[PATCH 0/4] Unprivileged daemon

1. Allow overriding utilities.
2. Allow overriding rootfs location.
3. Handle tun interface cleanup when disconnect.
4. Support route and dns metrics.
5. Support password program to allow UI integration.

This patch is against vpnc repository.
It is a resent as was not applied.

Alon Bar-Lev (4):
  allow overriding utilities and /var/run location
  delete tun address on disconnect
  always run the vpnc-script at exit
  support password program

 config.c        |  17 +++++-
 config.h        |   1 +
 tunip.c         |   2 +-
 tunip.h         |   1 +
 vpnc-disconnect |   3 +-
 vpnc-script     |  42 +++++++++++----
 vpnc.c          | 165 ++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 vpnc.h          |   2 +
 8 files changed, 215 insertions(+), 18 deletions(-)

--

-- 
1.8.1.5
Permalink | Reply | 6 comments |
headers
vpnc | 10 Mar 2013 16:01
Picon
Picon
Favicon

svn commit: vpnc r526 - /branches/vpnc-nortel/vpnc-script /trunk/vpnc-script

Author: Antonio Borneo
Date: Sun Mar 10 16:01:43 2013
New Revision: 526

Log:
vpnc-script: document "reason=reconnect"

After recent modification, a new value can be passed through
environment variable "reason".
Add it in comment header.

Signed-off-by: Antonio Borneo <borneo.antonio@...>

Modified:
    branches/vpnc-nortel/vpnc-script
    trunk/vpnc-script

Modified: branches/vpnc-nortel/vpnc-script
==============================================================================
--- branches/vpnc-nortel/vpnc-script (original)
+++ branches/vpnc-nortel/vpnc-script Sun Mar 10 16:01:43 2013
 <at>  <at>  -21,7 +21,7  <at>  <at> 
 ################
 #
 # List of parameters passed through environment
-#* reason                       -- why this script was called, one of: pre-init connect disconnect
+#* reason                       -- why this script was called, one of: pre-init connect disconnect reconnect
 #* VPNGATEWAY                   -- vpn gateway address (always present)
 #* TUNDEV                       -- tunnel device (always present)
 #* INTERNAL_IP4_ADDRESS         -- address (always present)
(Continue reading)

Permalink | Reply | 1 comment |
headers
vpnc | 10 Mar 2013 16:01
Picon
Picon
Favicon

svn commit: vpnc r525 - /branches/vpnc-nortel/vpnc-script /trunk/vpnc-script

Author: Antonio Borneo
Date: Sun Mar 10 16:01:33 2013
New Revision: 525

Log:
Fix various issues on FreeBSD

- duplicate creation of tun devices
- cleanup of created tun device
- deadlock of vpnc holding an open file descriptor on /dev/tunN
- properly restoring /etc/resolv.conf

Signed-off-by: Emanuel Haupt <ehaupt@...>
Signed-off-by: David Woodhouse <David.Woodhouse@...>

Modified:
    branches/vpnc-nortel/vpnc-script
    trunk/vpnc-script

Modified: branches/vpnc-nortel/vpnc-script
==============================================================================
--- branches/vpnc-nortel/vpnc-script (original)
+++ branches/vpnc-nortel/vpnc-script Sun Mar 10 16:01:33 2013
 <at>  <at>  -121,7 +121,7  <at>  <at> 
 	include /lib/network
 	MODIFYRESOLVCONF=modify_resolvconf_openwrt
 	RESTORERESOLVCONF=restore_resolvconf_openwrt
-elif [ -x /sbin/resolvconf ]; then # Optional tool on Debian, Ubuntu, Gentoo
+elif [ -x /sbin/resolvconf ] && [ "$OS" != "FreeBSD" ]; then # Optional tool on Debian, Ubuntu, Gentoo - but
not FreeBSD, it seems to work different
(Continue reading)

Permalink | Reply | 0 comments |
headers
vpnc | 10 Mar 2013 16:01
Picon
Picon
Favicon

svn commit: vpnc r524 - /branches/vpnc-nortel/vpnc-script /trunk/vpnc-script

Author: Antonio Borneo
Date: Sun Mar 10 16:01:25 2013
New Revision: 524

Log:
handle creating/destroying the tun device on OpenBSD

Signed-off-by: Stuart Henderson <sthen@...>
Signed-off-by: David Woodhouse <David.Woodhouse@...>

Modified:
    branches/vpnc-nortel/vpnc-script
    trunk/vpnc-script

Modified: branches/vpnc-nortel/vpnc-script
==============================================================================
--- branches/vpnc-nortel/vpnc-script (original)
+++ branches/vpnc-nortel/vpnc-script Sun Mar 10 16:01:25 2013
 <at>  <at>  -198,7 +198,7  <at>  <at> 

 destroy_tun_device() {
 	case "$OS" in
-	NetBSD|FreeBSD) # and probably others...
+	NetBSD|FreeBSD|OpenBSD) # and probably others...
 		ifconfig "$TUNDEV" destroy
 		;;
 	esac
 <at>  <at>  -317,7 +317,7  <at>  <at> 

 	del_network_route() {
(Continue reading)

Permalink | Reply | 0 comments |
headers
vpnc | 10 Mar 2013 16:01
Picon
Picon
Favicon

svn commit: vpnc r523 - /branches/vpnc-nortel/vpnc-script /trunk/vpnc-script

Author: Antonio Borneo
Date: Sun Mar 10 16:01:16 2013
New Revision: 523

Log:
redirect stderr from which (not grep) to /dev/null

Signed-off-by: Stuart Henderson <sthen@...>
Signed-off-by: David Woodhouse <David.Woodhouse@...>

Modified:
    branches/vpnc-nortel/vpnc-script
    trunk/vpnc-script

Modified: branches/vpnc-nortel/vpnc-script
==============================================================================
--- branches/vpnc-nortel/vpnc-script (original)
+++ branches/vpnc-nortel/vpnc-script Sun Mar 10 16:01:16 2013
 <at>  <at>  -89,7 +89,7  <at>  <at> 
 fi

 # stupid SunOS: no blubber in /usr/local/bin ... (on stdout)
-IPROUTE="`which ip | grep '^/'`" 2> /dev/null
+IPROUTE="`which ip 2> /dev/null | grep '^/'`"

 if ifconfig --help 2>&1 | grep BusyBox > /dev/null; then
 	ifconfig_syntax_inet=""

Modified: trunk/vpnc-script
==============================================================================
(Continue reading)

Permalink | Reply | 0 comments |
headers
vpnc | 10 Mar 2013 16:00
Picon
Picon
Favicon

svn commit: vpnc r522 - /branches/vpnc-nortel/vpnc-script /trunk/vpnc-script

Author: Antonio Borneo
Date: Sun Mar 10 16:00:34 2013
New Revision: 522

Log:
Use /32 for netmask to iproute, not /255.255.255.255

Older versions of iproute (e.g. 2.6.18-7 on RHEL5.2) can't cope with seeing
/255.255.255.255.

Thanks to Andrew Daviel for pointing it out.

Signed-off-by: David Woodhouse <David.Woodhouse@...>

Modified:
    branches/vpnc-nortel/vpnc-script
    trunk/vpnc-script

Modified: branches/vpnc-nortel/vpnc-script
==============================================================================
--- branches/vpnc-nortel/vpnc-script (original)
+++ branches/vpnc-nortel/vpnc-script Sun Mar 10 16:00:34 2013
 <at>  <at>  -168,7 +168,7  <at>  <at> 
 	# Point to point interface require a netmask of 255.255.255.255 on some systems
 	if [ -n "$IPROUTE" ]; then
 		$IPROUTE link set dev "$TUNDEV" up mtu "$MTU"
-		$IPROUTE addr add "$INTERNAL_IP4_ADDRESS/255.255.255.255" peer "$INTERNAL_IP4_ADDRESS" dev "$TUNDEV"
+		$IPROUTE addr add "$INTERNAL_IP4_ADDRESS/32" peer "$INTERNAL_IP4_ADDRESS" dev "$TUNDEV"
 	else
 		ifconfig "$TUNDEV" ${ifconfig_syntax_inet} "$INTERNAL_IP4_ADDRESS" $ifconfig_syntax_ptp
(Continue reading)

Permalink | Reply | 0 comments |

Gmane