OpenVPN / OpenVPN/openvpn

No IPv4 Address

Open
#234 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug DCO outdated code Windows
Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
When using OpenVPN 2.6.0, our Windows clients can't assign the IPv4 address given by the server, which results in a later failure when the client tries to set routes dependent on that IPv4 address. The issue does not appear when using the old tap-windows6 driver by setting disable-dco in the client config.

Redacted Log (I hope it is still readable enough):

2023-01-27 13:56:46 Note: --cipher is not set. OpenVPN versions before 2.5 defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
2023-01-27 13:56:46 OpenVPN 2.6.0 [git:v2.6.0/b999466418dddb89] Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Jan 25 2023
2023-01-27 13:56:46 Windows version 10.0 (Windows 10 or greater), amd64 executable
2023-01-27 13:56:46 library versions: OpenSSL 3.0.7 1 Nov 2022, LZO 2.10
2023-01-27 13:56:46 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
2023-01-27 13:56:46 Need hold release from management interface, waiting...
2023-01-27 13:56:47 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:62515
2023-01-27 13:56:47 MANAGEMENT: CMD 'state on'
2023-01-27 13:56:47 MANAGEMENT: CMD 'log on all'
2023-01-27 13:56:47 MANAGEMENT: CMD 'echo on all'
2023-01-27 13:56:47 MANAGEMENT: CMD 'bytecount 5'
2023-01-27 13:56:47 MANAGEMENT: CMD 'state'
2023-01-27 13:56:47 MANAGEMENT: CMD 'hold off'
2023-01-27 13:56:47 MANAGEMENT: CMD 'hold release'
2023-01-27 13:56:47 MANAGEMENT: >STATE:1674824207,RESOLVE,,,,,,
2023-01-27 13:56:47 TCP/UDP: Preserving recently used remote address: [AF_INET]REMOTE_IP:1194
2023-01-27 13:56:47 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-01-27 13:56:47 UDP link local: (not bound)
2023-01-27 13:56:47 UDP link remote: [AF_INET]REMOTE_IP:1194
2023-01-27 13:56:47 MANAGEMENT: >STATE:1674824207,WAIT,,,,,,
2023-01-27 13:56:47 MANAGEMENT: >STATE:1674824207,AUTH,,,,,,
2023-01-27 13:56:47 TLS: Initial packet from [AF_INET]REMOTE_IP:1194, sid=xxxxxxxx xxxxxxxx
2023-01-27 13:56:47 VERIFY OK: depth=3, REDACTED
2023-01-27 13:56:47 VERIFY OK: depth=2, REDACTED
2023-01-27 13:56:47 VERIFY OK: depth=1, REDACTED
2023-01-27 13:56:47 VERIFY KU OK
2023-01-27 13:56:47 Validating certificate extended key usage
2023-01-27 13:56:47 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2023-01-27 13:56:47 VERIFY EKU OK
2023-01-27 13:56:47 VERIFY X509NAME OK: REDACTED
2023-01-27 13:56:47 VERIFY OK: depth=0, REDACTED
2023-01-27 13:56:47 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 4096 bit RSA, signature: RSA-SHA256
2023-01-27 13:56:47 [REMOTE_DOMAIN] Peer Connection Initiated with [AF_INET]REMOTE_IP:1194
2023-01-27 13:56:47 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
2023-01-27 13:56:47 TLS: tls_multi_process: initial untrusted session promoted to trusted
2023-01-27 13:56:47 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS DNS_v4_IP,dhcp-option DNS6 DNS_v6_IP,dhcp-option NTP NTP_v4_IP_1,dhcp-option NTP NTP_v4_IP_2,dhcp-option DOMAIN COMPANY_DOMAIN,ip-win32 dynamic 0 86400,route COMPANY_IP_NET 255.255.0.0,route-ipv6 COMPANY_IP_NET_v6/48,route remote_host 255.255.255.255 net_gateway,tun-ipv6,route-gateway VPN_CLIENT_IPv4_GATEWAY,topology subnet,ping 15,ping-restart 120,ifconfig-ipv6 VPN_CLIENT_IPv6/64 VPN_CLIENT_IPv6_GATEWAY,ifconfig VPN_CLIENT_IPv4 255.255.255.0,peer-id 3,cipher AES-256-GCM'
2023-01-27 13:56:47 OPTIONS IMPORT: timers and/or timeouts modified
2023-01-27 13:56:47 OPTIONS IMPORT: --ifconfig/up options modified
2023-01-27 13:56:47 OPTIONS IMPORT: route options modified
2023-01-27 13:56:47 OPTIONS IMPORT: route-related options modified
2023-01-27 13:56:47 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2023-01-27 13:56:47 OPTIONS IMPORT: peer-id set
2023-01-27 13:56:47 OPTIONS IMPORT: data channel crypto options modified
2023-01-27 13:56:47 interactive service msg_channel=572
2023-01-27 13:56:47 GDG6: remote_host_ipv6=n/a
2023-01-27 13:56:47 NOTE: GetBestInterfaceEx returned error: Element nicht gefunden.   (code=1168)
2023-01-27 13:56:47 MANAGEMENT: >STATE:1674824207,ASSIGN_IP,,VPN_CLIENT_IPv4,,,,,VPN_CLIENT_IPv6
2023-01-27 13:56:47 IPv4 MTU set to 1300 on interface 9 using service
2023-01-27 13:56:47 INET6 address service: add VPN_CLIENT_IPv6/128
2023-01-27 13:56:47 add_route_ipv6(VPN_CLIENT_IPv6_NETWORK/64 -> VPN_CLIENT_IPv6 metric 0) IF 9
2023-01-27 13:56:47 IPv6 route addition via service succeeded
2023-01-27 13:56:47 IPv6 dns servers set using service
2023-01-27 13:56:47 IPv6 MTU set to 1300 on interface 9 using service
2023-01-27 13:56:47 C:\WINDOWS\system32\route.exe ADD REMOTE_IP MASK 255.255.255.255 DEFAULT_IPv4_GATEWAY
2023-01-27 13:56:47 Route addition via service succeeded
2023-01-27 13:56:47 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 VPN_CLIENT_IPv4_GATEWAY
2023-01-27 13:56:47 Warning: route gateway is not reachable on any active network adapters: VPN_CLIENT_IPv4_GATEWAY
2023-01-27 13:56:47 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 VPN_CLIENT_IPv4_GATEWAY
2023-01-27 13:56:47 Warning: route gateway is not reachable on any active network adapters: VPN_CLIENT_IPv4_GATEWAY
2023-01-27 13:56:47 MANAGEMENT: >STATE:1674824207,ADD_ROUTES,,,,,,
2023-01-27 13:56:47 C:\WINDOWS\system32\route.exe ADD COMPANY_IP_NET MASK 255.255.0.0 VPN_CLIENT_IPv4_GATEWAY METRIC 200
2023-01-27 13:56:47 Warning: route gateway is not reachable on any active network adapters: VPN_CLIENT_IPv4_GATEWAY
2023-01-27 13:56:47 C:\WINDOWS\system32\route.exe ADD REMOTE_IP MASK 255.255.255.255 DEFAULT_IPv4_GATEWAY METRIC 200
2023-01-27 13:56:47 Route addition via service failed because route exists
2023-01-27 13:56:47 add_route_ipv6(COMPANY_IP_NET_v6/48 -> VPN_CLIENT_IPv6_GATEWAY metric 200) IF 9
2023-01-27 13:56:47 IPv6 route addition via service succeeded
2023-01-27 13:56:47 add_route_ipv6(::/3 -> VPN_CLIENT_IPv6_GATEWAY metric 200) IF 9
2023-01-27 13:56:47 IPv6 route addition via service succeeded
2023-01-27 13:56:47 add_route_ipv6(2000::/4 -> VPN_CLIENT_IPv6_GATEWAY metric 200) IF 9
2023-01-27 13:56:47 IPv6 route addition via service succeeded
2023-01-27 13:56:47 add_route_ipv6(3000::/4 -> VPN_CLIENT_IPv6_GATEWAY metric 200) IF 9
2023-01-27 13:56:47 IPv6 route addition via service succeeded
2023-01-27 13:56:47 add_route_ipv6(fc00::/7 -> VPN_CLIENT_IPv6_GATEWAY metric 200) IF 9
2023-01-27 13:56:47 IPv6 route addition via service succeeded
2023-01-27 13:56:47 Data Channel: using negotiated cipher 'AES-256-GCM'
2023-01-27 13:56:47 Initialization Sequence Completed
2023-01-27 13:56:47 MANAGEMENT: >STATE:1674824207,CONNECTED,ROUTE_ERROR,VPN_CLIENT_IPv4,REMOTE_IP,1194,,,VPN_CLIENT_IPv6

Tested on Windows 10 2004, which should correspond to 20H1. I have also tested the same config on 21H2 with the same results.

Is this an issue in our config or a problem in the new dco driver?

Expected behavior
A working IPv4 address and correctly configured routes

Version information (please complete the following information):

  • OS: Windows 10
  • OpenVPN version: 2.6.0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source files or tests are mentioned. Reproduce the connection on Windows 10 with OpenVPN 2.6.0 and DCO enabled, then compare it with the same configuration using disable-dco; done means the IPv4 address is assigned and dependent routes are configured without ROUTE_ERROR.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.