Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OpenVPN 2.3.6 cannot grab smartos gateway information, OpenVPN devs think the issue is fixed in 2.3.11 #386

Closed
baetheus opened this issue Jul 8, 2016 · 1 comment
Assignees

Comments

@baetheus
Copy link

baetheus commented Jul 8, 2016

I submitted an issue with openvpn about openvpn 2.3.6 not being able to find the current default gateway on smartos. Following is the original ticket that should be available here: https://community.openvpn.net/openvpn/ticket/696

GuestOS: SmartOS minimal-64 15.2.0 and SmartOS minimal-64 16.1.0
HostOS: SmartOS Live Image v0.147+ build: 20160527T033529Z

Openvpn build:
    [root@transmission ~]# openvpn --version
    OpenVPN 2.3.6 x86_64-sun-solaris2.11 [SSL (OpenSSL)] [LZO] [IPv6] built on Aug 30 2015
    library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.09
    Originally developed by James Yonan
    Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@…>
    Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=no enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=no enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=no with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no

Routing table: ​https://gist.github.com/anonymous/4259fd6dbf2b492b8a5805c1d3ba4f41
Openvpn config: ​https://gist.github.com/anonymous/543c6fc8b3aff6c4a98603058ede6ecd
Logs: ​https://gist.github.com/anonymous/00c3a70f3850e63c80371adadc50d9bb
The vpn provider is, as can be seen in the config and logs, Private Internet Access.

Steps to reproduce on a fresh install:
Install openvpn: # pkgin in openvpn
Copy config, certs, and auth to /opt/local/etc/openvpn/
Enable openvpn service: # svcadm enable -r openvpn
Reboot
Optional: access logs with: # tail -F $(svcs -L openvpn)

Temporary solution:
Manually add routes
route add default <tun1 internal address> 128.0.0.0
route add <vpn public address> <internal gateway> 255.255.255.255
route add 128.0.0.0 <tun1 internal address> 128.0.0.0
Check that traffic is forwarding properly
    [root@test ~]# curl portquiz.net:666
    Port 666 test successful!
    Your IP: <vpn public address>

The actual issue is that openvpn cannot detect the current default gateway, and thus fails before setting up all the routes for vpn tunneling.

The proffered advice was to run openvpn 2.3.11, as there is a commit that suggests the issue has already been resolved. In building openvpn 2.3.11 I ran into some issues with tap headers not being found, which is not surprising to me. I'm hoping I can either get some guidance on properly building openvpn 2.3.11 against smartos minimal-64 16.1.0 or perhaps a package upgrade in pkgsrc.

Thanks!

@jperkin jperkin self-assigned this Jul 8, 2016
@jperkin
Copy link
Collaborator

jperkin commented Jul 11, 2016

I updated this in pkgsrc trunk and backported to 2016Q2 in 4618929, it will be available in that release shortly.

@jperkin jperkin closed this as completed Jul 11, 2016
jperkin pushed a commit that referenced this issue Aug 24, 2016
Changes from 3.2.2 to 3.2.3
Improvements

    It is now possible to use HDF5 with the new shared library naming scheme (>= 1.8.10, hdf5.dll instead of hdf5dll.dll) on Windows (gh-540). Thanks to Tadeu Manoel.
    Now :program: ptdump sorts output by node name and does not print a backtrace if file cannot be opened. Thanks to Zbigniew Jędrzejewski-Szmek.

Bugs fixed

    Only run tables.tests.test_basics.UnicodeFilename if the filesystem encoding is utf-8. Closes gh-485.
    Add lib64 to posix search path. (closes gh-507) Thanks to Mehdi Sadeghi.
    Ensure cache entries are removed if fewer than 10 (closes gh-529). Thanks to Graham Jones.
    Fix segmentation fault in a number of test cases that use index.Index (closes gh-532 and gh-533). Thanks to Diane Trout.
    Fixed the evaluation of transcendental functions when numexpr is compiled with VML support (closes gh-534, PR #536). Thanks to Tom Kooij.
    Make sure that index classes use buffersizes that are a multiple of chunkshape[0] (closes gh-538, PR #538). Thanks to Tom Kooij.
    Ensure benchmark paths exist before benchmarks are executed (PR #544). Thanks to rohitjamuar.

Other changes

    Minimum Cython version is now v0.21

Changes from 3.2.1.1 to 3.2.2
Bug fixed

    Fix AssertionError in Row.__init_loop. See gh-477.
    Fix issues with Cython 0.23. See gh-481.
    Only run tables.tests.test_basics.UnicodeFilename if the filesystem encoding is utf-8. Closes gh-485.
    Fix missing missing PyErr_Clear. See gh-#486.
    Fix the C type of some numpy attributes. See gh-494.
    Cast selection indices to integer. See gh-496.
    Fix indexesextension._keysort_string. Closes gh-497 and gh-498.

Changes from 3.2.1 to 3.2.1.1

    Fix permission on distributed source distribution

Other changes

    Minimum Cython version is now v0.21

Changes from 3.2.0 to 3.2.1
Bug fixed

    Fix indexesextension._keysort. Fixes gh-455. Thanks to Andrew Lin.

Changes from 3.1.1 to 3.2.0
Improvements

    The nrowsinbuf is better computed now for EArray/CArray having a small chunkshape in the main dimension. Fixes #285.

    PyTables should be installable very friendly via pip, including NumPy being installed automatically in the unlikely case it is not yet installed in the system. Thanks to Andrea Bedini.

    setup.py has been largely simplified and now it requires setuptools. Although we think this is a good step, please keep us informed this is breaking some installation in a very bad manner.

    setup.py now is able to used pkg-config, if available, to locate required libraries (hdf5, bzip2, etc.). The use of pkg-config can be controlled via setup.py command line flags or via environment variables. Please refer to the installation guide (in the User Manual) for details. Closes gh-442.

    It is now possible to create a new node whose parent is a softlink to another group (see gh-422). Thanks to Alistair Muldal.

    link.SoftLink objects no longer need to be explicitly dereferenced. Methods and attributes of the linked object are now automatically accessed when the user acts on a soft-link (see gh-399). Thanks to Alistair Muldal.

    Now ptrepack recognizes hardlinks and replicates them in the output (repacked) file. This saves disk space and makes repacked files more conformal to the original one. Closes gh-380.

    New pttree script for printing HDF5 file contents as a pretty ASCII tree (closes gh-400). Thanks to Alistair Muldal.

    The internal Blosc library has been downgraded to version 1.4.4. This is in order to still allow using multiple threads inside Blosc, even on multithreaded applications (see gh-411, gh-412, gh-437 and gh-448).

    The print_versions() function now also reports the version of compression libraries used by Blosc.

    Now the setup.py tries to use the ‘-march=native’ C flag by default. In falls back on ‘-msse2’ if ‘-march=native’ is not supported by the compiler. Closes gh-379.

    Fixed a spurious unicode comparison warning (closes gh-372 and gh-373).

    Improved handling of empty string attributes. In previous versions of PyTables empty string were stored as scalar HDF5 attributes having size 1 and value ‘0’ (an empty null terminated string). Now empty string are stored as HDF5 attributes having zero size

    Added a new cookbook recipe and a couple of examples for simple threading with PyTables.

    The redundant utilsextension.get_indices() function has been eliminated (replaced by slice.indices()). Closes gh-195.

    Allow negative indices in point selection (closes gh-360)

    Index wasn’t being used if it claimed there were no results. Closes gh-351 (see also gh-353)

    Atoms and Col types are no longer generated dynamically so now it is easier for IDEs and static analysis tool to handle them (closes gh-345)

    The keysort functions in idx-opt.c have been cythonised using fused types. The perfomance is mostly unchanged, but the code is much more simpler now. Thanks to Andrea Bedini.

    Small unit tests re-factoring:

        print_versions() and tests.common.print_heavy() functions

            moved to the tests.common module

        always use print_versions() when test modules are called as scripts

        use the unittest2 package in Python 2.6.x

        removed internal machinery used to replicate unittest2 features

        always use tests.common.PyTablesTestCase as base class for all test cases

        code of the old tasts.common.cleanup() function has been moved to tests.common.PyTablesTestCase.tearDown() method

        new implementation of tests.common.PyTablesTestCase.assertWarns() compatible with the one provided by the standard unittest module in Python >= 3.2

        use tests.common.PyTablesTestCase.assertWarns() as context manager when appropriate

        use the unittest.skipIf() decorator when appropriate

        new :class:tests.comon.TestFileMixin: class

Bugs fixed

    Fixed compatibility problems with numpy 1.9 and 1.10-dev (closes gh-362 and gh-366)
    Fixed compatibility with Cython >= 0.20 (closes gh-386 and gh-387)
    Fixed support for unicode node names in LRU cache (only Python 2 was affected). Closes gh-367 and gh-369.
    Fixed support for unicode node titles (only Python 2 was affected). Closes gh-370 and gh-374.
    Fixed a bug that caused the silent truncation of unicode attributes containing the ‘0’ character. Closes gh-371.
    Fixed descr_from_dtype() to work as expected with complex types. Closes gh-381.
    Fixed the tests.test_basics.ThreadingTestCase test case. Closes gh-359.
    Fix incomplete results when performing the same query twice and exhausting the second iterator before the first. The first one writes incomplete results to seqcache (gh-353)
    Fix false results potentially going to seqcache if tableextension.Row.update() is used during iteration (see gh-353)
    Fix Column.create_csindex() when there’s NaNs
    Fixed handling of unicode file names on windows (closes gh-389)
    No longer not modify sys.argv at import time (closes gh-405)
    Fixed a performance issue on NFS (closes gh-402)
    Fixed a nasty problem affecting results of indexed queries. Closes gh-319 and probably gh-419 too.
    Fixed another problem affecting results of indexed queries too. Closes gh-441.
    Replaced “len(xrange(start, stop, step))” -> “len(xrange(0, stop - start, step))” to fix issues with large row counts with Python 2.x. Fixes #447.

Other changes

    Cython is not a hard dependency anymore (although developers will need it so as to generated the C extension code).

    The number of threads used by default for numexpr and Blosc operation that was set to the number of available cores have been reduced to 2. This is a much more reasonable setting for not creating too much overhead.
jperkin pushed a commit that referenced this issue Sep 16, 2016
Security
- Fixed missing padding length check required by PKCS1 v2.2 in
  mbedtls_rsa_rsaes_pkcs1_v15_decrypt(). (considered low impact)
- Fixed potential integer overflow to buffer overflow in
  mbedtls_rsa_rsaes_pkcs1_v15_encrypt() and
  mbedtls_rsa_rsaes_oaep_encrypt(). (not triggerable remotely in
  (D)TLS).
- Fixed potential integer underflow to buffer overread in
  mbedtls_rsa_rsaes_oaep_decrypt(). It is not triggerable remotely
in SSL/TLS.

Bugfix
- Fixed bug in mbedtls_mpi_add_mpi() that caused wrong results
  when the three arguments were the same (in-place doubling). #309
- Fixed issue in Makefile that prevented building using armar.
  #386
- Fixed issue that caused a hang when generating RSA keys of odd
  bitlength.
- Fixed bug in mbedtls_rsa_rsaes_pkcs1_v15_encrypt() that made
  null pointer dereference possible.
- Fixed issue that caused a crash if invalid curves were passed to
  mbedtls_ssl_conf_curves(). #373

Changes
- On ARM platforms, when compiling with -O0 with GCC, Clang or
  armcc5, don't use the optimized assembly for bignum
  multiplication. This removes the need to pass -fomit-frame-pointer
  to avoid a build error with -O0.
- Disabled SSLv3 in the default configuration.
jperkin pushed a commit that referenced this issue Mar 20, 2017
# Change Log

## [3.5.5] - 2017-02-24

[3.5.5]: hashie/hashie@v3.5.4...v3.5.5

### Added

* [#326](hashie/hashie#326): Added `Hashie::Extensions::Mash::KeepOriginalKeys` to give Mashes the ability to keep the original structure given to it - [@michaelherold](https://github.com/michaelherold).

### Fixed

* [#415](hashie/hashie#415): Fixed Mash logging keys multiple times which lead to a bad user experience or, in some cases, errors - [@michaelherold](https://github.com/michaelherold).

## [3.5.4] - 2017-02-22

[3.5.4]: hashie/hashie@v3.5.3...v3.5.4

### Added

* [#412](hashie/hashie#412): Added a Hashie::Extensions::Mash::SymbolizeKeys extension that overrides the default stringification behavior for keys - [@michaelherold](https://github.com/michaelherold).

### Fixed

* [#409](hashie/hashie#409): Fixed Railtie detection for projects where Rails is defined but Railties are not availble - [@CallumD](https://github.com/callumd).
* [#411](hashie/hashie#411): Fixed a performance regression from 3.4.3 that caused a 10x slowdown in OmniAuth - [@michaelherold](https://github.com/michaelherold).

## [3.5.3] - 2017-02-11

[3.5.3]: hashie/hashie@v3.5.2...v3.5.3

### Fixed

* [#402](hashie/hashie#402): Use a Railtie to set Hashie.logger on rails boot - [@matthewrudy](https://github.com/matthewrudy).
* [#406](hashie/hashie#406): Ensure that subclasses that disable warnings propagate that setting to grandchild classes - [@michaelherold](https://github.com/michaelherold).
* Your contribution here.

## [3.5.2] - 2017-02-10

[3.5.2]: hashie/hashie@v3.5.1...v3.5.2

### Added

* [#395](hashie/hashie#395): Add the ability to disable warnings in Mash subclasses - [@michaelherold](https://github.com/michaelherold).
* [#400](hashie/hashie#400): Fix Hashie.logger load and set the Hashie logger to the Rails logger in a Rails environment - [@michaelherold](https://github.com/michaelherold).

### Fixed

* [#396](hashie/hashie#396): Fix for specs in #381: Incorrect use of shared context meant example was not being run - [@biinari](https://github.com/biinari).
* [#399](hashie/hashie#399): Fix passing Pathname object to Hashie::Mesh.load() - [@albb0920](https://github.com/albb0920).

### Miscellanous

* [#397](hashie/hashie#397): Add the integration specs harness into the main test tasks - [@michaelherold](https://github.com/michaelherold).

## [3.5.1] - 2017-01-31

* [#392](hashie/hashie#392): Fix for #391: Require all dependencies of Hashie::Mash - [@dblock](https://github.com/dblock).

[3.5.1]: hashie/hashie@v3.5.0...v3.5.1

## [3.5.0] - 2017-01-31

* [#386](hashie/hashie#386): Fix for #385: Make `deep_merge` always `deep_dup` nested hashes before merging them in so that there are no shared references between the two hashes being merged. - [@mltsy](https://github.com/mltsy).
* [#389](hashie/hashie#389): Support Ruby 2.4.0 - [@camelmasa](https://github.com/camelmasa).

[3.5.0]: hashie/hashie@v3.4.6...v3.5.0

### Added

* [#381](hashie/hashie#381): Add a logging layer that lets us report potential issues to our users. As the first logged issue, report when a `Hashie::Mash` is attempting to overwrite a built-in method, since that is one of our number one questions - [@michaelherold](https://github.com/michaelherold).

### Changed

* [#384](hashie/hashie#384): Updated to CodeClimate 1.x - [@boffbowsh](https://github.com/boffbowsh).

### Fixed

* [#369](hashie/hashie#369): If a translation for a property exists when using IndifferentAccess and IgnoreUndeclared, use the translation to find the property - [@whitethunder](https://github.com/whitethunder).
* [#376](hashie/hashie#376): Leave string index unchanged if it can't be converted to integer for Array#dig - [@sazor](https://github.com/sazor).
* [#377](hashie/hashie#377): Dont use Rubygems to check ruby version - [@sazor](https://github.com/sazor).
* [#378](hashie/hashie#378): Deep find all searches inside all nested hashes - [@sazor](https://github.com/sazor).
* [#380](hashie/hashie#380): Evaluate procs default values of Dash in object initialization - [@sazor](https://github.com/sazor).

### Miscellanous

* [#387](hashie/hashie#387): Fix builds failing due to Rake 11 having a breaking change - [@michaelherold](https://github.com/michaelherold).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants