nm-openvpn with preshared key doesn't work

Hello

Please export the configuration and attach it here. Also try it from command line and also attach that working configuration here.

The command-line which is executed when openvpn gets called is:

/usr/sbin/openvpn --remote routus.ip.addr --ns-cert-type server --nobind --dev tun --proto udp --port 1194 --syslog nm-openvpn --up /usr/lib/network-manager-openvpn/nm-openvpn-service-openvpn-helper --up-restart --persist-key --persist-tun --management 127.0.0.1 1194 --management-query-passwords --secret dev --secret /home/patrick/test.key --ifconfig 192.168.1.222 192.168.1.220

When removing the parameter "--ns-cert-type server" through a wrapper-script to openvpn openvpn starts fine, but the "nm-openvpn-service-openvpn-helper" complains, that it can't pull configuration data:

    May 22 09:19:52 portus nm-openvpn-service-openvpn-helper: <WARNING>^I main (): nm-openvpn-service-openvpn-helper didn't receive a VPN Gateway from openvpn.
    May 22 09:19:52 portus nm-openvpn[13076]: script failed: shell command exited with error status: 1

after removing the "--up" parameter through the wrapper-script, too, openvpn starts fine and the tunnel can be user for quite some sekonds, but then network-manager complains:

    May 22 09:24:04 portus NetworkManager: <WARN> nm_vpn_service_process_signal(): VPN failed for service 'org.freedesktop.NetworkManager.openvpn', signal 'ConnectFailed', with message 'The VPN login failed because the VPN program could not connect to the VPN server.'.

starting openvpn from the command line with the parameters mentioned above (without --ns-cert-type and --up) works fine.

got the same issue here. it works fine from the commandline, but via
network-manager-openvpn I get the following error (same as above).

I use a preshared key too.

Jul 26 18:45:59 trinity NetworkManager: <info> Will activate VPN connection 'stern', service 'org.freedesktop.NetworkManager.openvpn', user_name 'up', vpn_data 'connection-type / shared-key / dev / tun / remote / 213.208.137.47 / port / 1194 / proto / udp / servercert-insecure / no / ca / / cert / / key / / comp-lzo / yes / shared-key / /home/up/roterstern_openvpn.key / local-ip / 10.1.0.2 / remote-ip / 10.1.0.1 / username / ', route ''.
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 1 of 4 (Connection Prepare) scheduled...
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 1 of 4 (Connection Prepare) ran VPN service daemon org.freedesktop.NetworkManager.openvpn (PID 2474)
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 1 of 4 (Connection Prepare) complete.
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 2 of 4 (Connection Prepare Wait) scheduled...
Jul 26 18:45:59 trinity NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.openvpn' signaled state change 1 -> 6.
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 2 of 4 (Connection Prepare Wait) waiting...
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 2 of 4 (Connection Prepare Wait) complete.
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 3 of 4 (Connect) scheduled...
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 3 of 4 (Connect) sending connect request.
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 3 of 4 (Connect) request sent, waiting for reply...
Jul 26 18:45:59 trinity NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.openvpn' signaled state change 6 -> 3.
Jul 26 18:45:59 trinity nm-openvpn[2477]: Options error: Parameter ns_cert_type can only be specified in TLS-mode, i.e. where --tls-server or --tls-client is also specified.
Jul 26 18:45:59 trinity nm-openvpn[2477]: Use --help for more information.
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 3 of 4 (Connect) reply received.
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 4 of 4 (IP Config Get) timeout scheduled...
Jul 26 18:45:59 trinity NetworkManager: <info> VPN Activation (stern) Stage 3 of 4 (Connect) complete, waiting for IP configuration...
Jul 26 18:45:59 trinity NetworkManager: <WARN> nm_vpn_service_process_signal(): VPN failed for service 'org.freedesktop.NetworkManager.openvpn', signal 'ConnectFailed', with message 'The VPN login failed because the VPN program could not connect to the VPN server.'.
Jul 26 18:45:59 trinity NetworkManager: <debug> [1217090759.633709] nm_dbus_signal_filter(): NetworkManagerInfo triggered update of VPN connection 'stern'
Jul 26 18:45:59 trinity NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.openvpn' signaled state change 3 -> 6.
Jul 26 ...

I got the same issue. (network-manager-openvpn 0.3.2svn2342-1ubuntu4 installed, ubuntu 7.10 "gutsy")

I investigated trouble and found:

1. Option "Edit VPN connection -> Optional -> X.509: Allow server certificate without server extension" doesn't needed when using preshared key. If it unchecked, commandline option "--ns-cert-type server" is added to openvpn call and all things gets broken. If it checked, that option is not added.

2. When using preshared key, openvpn doesn't pass environment variable "trusted_ip" to "--up" script, so nm-openvpn-service-openvpn-helper reports "didn't receive a VPN Gateway from openvpn" and returns error code. I wrote small and ugly patch, which can help authors of nm-openvpn to understand problem and to find better solution:

diff -ruN network-manager-openvpn_0.3.2svn2342.orig/src/nm-openvpn-service-openvpn-helper.c network-manager-openvpn_0.3.2svn2342.orig_fixed/src/nm-openvpn-service-openvpn-helper.c
--- network-manager-openvpn_0.3.2svn2342.orig/src/nm-openvpn-service-openvpn-helper.c 2007-02-28 13:57:49.000000000 +0300
+++ network-manager-openvpn_0.3.2svn2342.orig_fixed/src/nm-openvpn-service-openvpn-helper.c 2008-08-03 04:23:35.000000000 +0400
@@ -340,6 +340,7 @@
   // print_env();

   vpn_gateway = getenv( "trusted_ip" );
+ if (!vpn_gateway) vpn_gateway = getenv( "remote_1" );
   tundev = getenv ("dev");
   ip4_ptp = getenv("ifconfig_remote");
   ip4_address = getenv("ifconfig_local");

I have the same problem.

Simple tunnel, shared key over TCP. Fairly straightforward. Works if I use openvpn from the commandline, fails when using network manager with the error described.

Configuration:

dev tun
proto tcp-client
remote the.ip.address.com
nobind
ifconfig 10.1.2.2 10.1.2.1
up ./home.up
down ./home.down
secret static.key
ping 15
tun-mtu 1500
mssfix 1400
verb 3

I get the same issue, too, using NM 0.6.6 on Gentoo with openvpn plugin 0.3.2_p20070621. Haven't yet tested on Hardy, but I will do so soon.

please test intrepid instead of hardy which has 0.7

I have a problem with 9.04 Jaunty and with 8.10 Intrepid, on both machines whenever I try to use STATIC KEY for OpenVPN, I'm asked for some Local IP Address, which is totally irrelevant.

Some guy tried doing some patches over here: http://<email address hidden>/msg10957.html

I suppose it's upstream, tho how much upstream development of NetworkManager does Ubuntu dev team contribute?

If any, then I guess it's just as valid to mention it here then.

Regards,

Bug also present on 9.04. Tested with shared key and UDP connection. Switching to TLS connection type worked fine.

May 7 19:49:36 host nm-openvpn[4301]: /sbin/ifconfig tun0 192.168.2.1 pointopo
int 192.168.3.1 mtu 1500
May 7 19:49:36 host kernel: [27688.086905] tun0: Disabled Privacy Extensions
May 7 19:49:36 host nm-openvpn[4301]: /usr/lib/network-manager-openvpn/nm-open
vpn-service-openvpn-helper tun0 1500 1544 192.168.2.1 192.168.3.1 init
May 7 19:49:36 host NetworkManager: <info> VPN plugin failed: 2
May 7 19:49:36 host nm-openvpn[4301]: script failed: external program exited w
ith error status: 1
May 7 19:49:36 host nm-openvpn[4301]: Exiting
May 7 19:49:36 host NetworkManager: <info> VPN plugin failed: 1
May 7 19:49:36 host NetworkManager: <info> VPN plugin state changed: 6
May 7 19:49:36 host NetworkManager: <info> VPN plugin state change reason: 0
May 7 19:49:36 host NetworkManager: <WARN> connection_state_changed(): Could
not process the request because no VPN connection was active.

same here on Jaunty, using UDP connection, static key., tap device. BTW, in that case the plugin should not ask for a remote IP, instead, openvpn expects the netmask. Actually, both the local IP and the netmask can also be requested via DHCP from a DHCP server on the other side.

Therefore, the whole interface is quite confusing and prone to provoke errors.

And, yes, on the command line openvpn works just fine for me.

bug has been confirmed both for intrepid and jaunty, thus the "incomplete" mark is no longer valid.

This seems to work again in current Karmic, Ubuntu 9.10. It hasn't worked at first but now seems to.
Could somebody confirm this?

doesn't work for me, unfortunately. I use a tap device.

It's not working with karmic....

It still forces the user to provide local and ... ip's which aren't needed at all for a straight forward and plain simple static key stetup...

----------------------
dev tap

proto tcp-client

comp-lzo

secret XXXXXXXXXX

remote XXXXXXXXX XXXX