{"action":"closed","issue":{"url":"https://api.github.com/repos/dlenski/openconnect/issues/104","repository_url":"https://api.github.com/repos/dlenski/openconnect","labels_url":"https://api.github.com/repos/dlenski/openconnect/issues/104/labels{/name}","comments_url":"https://api.github.com/repos/dlenski/openconnect/issues/104/comments","events_url":"https://api.github.com/repos/dlenski/openconnect/issues/104/events","html_url":"https://github.com/dlenski/openconnect/issues/104","id":319594295,"number":104,"title":"Can't pass traffic after upgrade to Ubuntu 18.04","user":{"login":"github-t","id":28241988,"avatar_url":"https://avatars2.githubusercontent.com/u/28241988?v=4","gravatar_id":"","url":"https://api.github.com/users/github-t","html_url":"https://github.com/github-t","followers_url":"https://api.github.com/users/github-t/followers","following_url":"https://api.github.com/users/github-t/following{/other_user}","gists_url":"https://api.github.com/users/github-t/gists{/gist_id}","starred_url":"https://api.github.com/users/github-t/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/github-t/subscriptions","organizations_url":"https://api.github.com/users/github-t/orgs","repos_url":"https://api.github.com/users/github-t/repos","events_url":"https://api.github.com/users/github-t/events{/privacy}","received_events_url":"https://api.github.com/users/github-t/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2018-05-02T15:10:20Z","updated_at":"2018-05-05T00:12:16Z","closed_at":"2018-05-05T00:12:16Z","author_association":"NONE","body":"# Problem description\r\n\r\n1. I ran openconnect-gp as follows: `openconnect --protocol=gp <gp_gateway_name> --dump -vvv`\r\n2. I get connected (it shows connected on the firewall side) but can't pass any traffic (ping and any other traffic don't work)\r\n3. An interested data point is that the firewall says I'm connected with Tunnel Type IPSec but the client reports \"Connected as <IP address>, using SSL\r\n4. I do see \"WARNING: Server asked us to submit HIP report\" and I've tried adding --csd-wrapper hipreport.sh but that gives the same results\r\n5. I did recompile just to be sure\r\n6. I was able to connect without issue before my upgrade to 18.04\r\n7. I'm able to connect via a Windows GP client from a VM running on the same machine\r\n\r\n# Operating system and openconnect-gp version\r\n\r\nopenconnect-gp version:\r\n\r\n```\r\nOpenConnect version v7.08-294-g5691d958\r\nUsing GnuTLS. Features present: PKCS#11, HOTP software token, TOTP software token, System keys, DTLS, ESP\r\nSupported protocols: anyconnect (default), nc, gp\r\n\r\n```\r\n\r\noperating system\r\n\r\n```\r\nLinux lt-tfg 4.13.0-39-generic #44-Ubuntu SMP Thu Apr 5 14:25:01 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux\r\n```\r\n\r\n# GlobalProtect VPN information\r\n\r\n```\r\nPOST https://<gp_gateway_name>/ssl-vpn/login.esp\r\nAttempting to connect to server <gp_gateway_ip>:443\r\nConnected to <gp_gateway_ip>:443\r\nSSL negotiation with <gp_gateway_name>\r\nConnected to HTTPS on <gp_gateway_name>\r\n> POST /ssl-vpn/login.esp HTTP/1.1\r\n> Host: <gp_gateway_name>\r\n> User-Agent: PAN GlobalProtect\r\n> X-Pad: 00000000000000000000\r\n> Content-Type: application/x-www-form-urlencoded\r\n> Content-Length: 172\r\n> \r\n> jnlpReady=jnlpReady&ok=Login&direct=yes&clientVer=4100&prot=https:&clientos=linux-64&server=<gp_gateway_name>&computer=<local_computer_name>&user=<gp_user_name>&passwd=<gp_password>\r\nGot HTTP response: HTTP/1.1 200 OK\r\nDate: Wed, 02 May 2018 14:42:28 GMT\r\nContent-Type: application/xml; charset=UTF-8\r\nContent-Length: 660\r\nConnection: keep-alive\r\nETag: \"facd2-2346-5a3ffe8f\"\r\nPragma: no-cache\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nX-FRAME-OPTIONS: DENY\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nSet-Cookie: PHPSESSID=<PHPSESSID>; secure; HttpOnly\r\nHTTP body length:  (660)\r\n< <?xml version=\"1.0\" encoding=\"utf-8\"?><jnlp><application-desc><argument>(null)</argument><argument>e94079743888a9deeeae847b7fed3536</argument><argument>ede5c71d981767b7f46be458838d69bf8f703754</argument><argument>Client_gateway_split-N</argument><argument><gp_user_name></argument><argument>LDAP_then_Local-VPN_Users</argument><argument>vsys1</argument><argument><user_domain></argument><argument>(null)</argument><argument></argument><argument></argument><argument></argument><argument>tunnel</argument><argument>-1</argument><argument>4100</argument><argument></argument><argument></argument><argument></argument><argument></argument></application-desc></jnlp>\r\nGlobalProtect login returned authentication-source=LDAP_then_Local-VPN_Users\r\nPOST https://<gp_gateway_name>/ssl-vpn/getconfig.esp\r\n> POST /ssl-vpn/getconfig.esp HTTP/1.1\r\n> Host: <gp_gateway_name>\r\n> User-Agent: PAN GlobalProtect\r\n> Cookie: PHPSESSID=<PHPSESSID>\r\n> X-Pad: 00000000000000000000000000000000000000000000000000000000000\r\n> Content-Type: application/x-www-form-urlencoded\r\n> Content-Length: 261\r\n> \r\n> client-type=1&protocol-version=p1&app-version=3.0.1-10&os-version=linux-64&clientos=linux-64&hmac-algo=sha1%2cmd5&enc-algo=aes-128-cbc%2caes-256-cbc&authcookie=<cookie>&portal=Client_gateway_split-N&user=<gp_user_name>&domain=<user_domain>\r\nGot HTTP response: HTTP/1.1 200 OK\r\nDate: Wed, 02 May 2018 14:42:28 GMT\r\nContent-Type: application/xml; charset=UTF-8\r\nContent-Length: 1827\r\nConnection: keep-alive\r\nETag: \"faccc-1f3-5a3ffe8f\"\r\nPragma: no-cache\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nX-FRAME-OPTIONS: DENY\r\nHTTP body length:  (1827)\r\n< \r\n< \t<response status=\"success\">\r\n< \t\t<need-tunnel>yes</need-tunnel>\r\n< \t\t<ssl-tunnel-url>/ssl-tunnel-connect.sslvpn</ssl-tunnel-url>\r\n< \t\t<portal>Client_gateway_split-N</portal>\r\n< \t\t<user><gp_user_name></user>\r\n< \t\t<lifetime>691200</lifetime>\r\n< \t\t<timeout>10800</timeout>\r\n< \t\t<disconnect-on-idle>10800</disconnect-on-idle>\r\n< \t\t<bw-c2s>1000</bw-c2s>\r\n< \t\t<bw-s2c>1000</bw-s2c>\r\n< \t\t<gw-address><gp_gateway_ip></gw-address>\r\n< \t\t<ip-address><user_ip></ip-address>\r\n< \t\t<netmask>255.255.255.255</netmask>\r\n< \t\t<dns>\r\n< \t\t\t<member><dns_server_1></member>\r\n< \t\t\t<member><dns_server_2></member>\r\n< \t\t</dns> \r\n< \t\t<wins>\r\n< \t\t</wins> \r\n< \t\t<dns-suffix>\r\n< \t\t\t<member><user_domain>.lan</member>\r\n< \t\t</dns-suffix> \r\n< \t\t<default-gateway><user_ip></default-gateway>\r\n< \t\t<mtu>0</mtu>\r\n< \t\t<no-direct-access-to-local-network>no</no-direct-access-to-local-network>\r\n< \t\t<access-routes>\r\n< \t\t\t<member><access_route_1></member>\r\n< \t\t\t<member><access_route_2></member>\r\n\r\n< \t\t\t<member><dns_server_1>/32</member>\r\n< \t\t\t<member><dns_server_2>/32</member>\r\n< \t\t</access-routes> \r\n< \t\t<exclude-access-routes>\r\n< \t\t</exclude-access-routes> \r\n< \t\t<ipsec>\r\n< \t\t\t<udp-port>4501</udp-port>\r\n< \t\t\t<ipsec-mode>esp-tunnel</ipsec-mode>\r\n< \t\t\t<enc-algo>aes-128-cbc</enc-algo>\r\n< \t\t\t<hmac-algo>sha1</hmac-algo>\r\n< \t\t\t<c2s-spi>0x750C1E99</c2s-spi>\r\n< \t\t\t<s2c-spi>0xE5464831</s2c-spi>\r\n< \t\t\t<akey-s2c>\r\n< \t\t\t\t<bits>160</bits>\r\n< \t\t\t\t<val><key></val>\r\n< \t\t\t</akey-s2c> \r\n< \t\t\t<ekey-s2c>\r\n< \t\t\t\t<bits>128</bits>\r\n< \t\t\t\t<val><key></val>\r\n< \t\t\t</ekey-s2c> \r\n< \t\t\t<akey-c2s>\r\n< \t\t\t\t<bits>160</bits>\r\n< \t\t\t\t<val><key></val>\r\n< \t\t\t</akey-c2s> \r\n< \t\t\t<ekey-c2s>\r\n< \t\t\t\t<bits>128</bits>\r\n< \t\t\t\t<val><key></val>\r\n< \t\t\t</ekey-c2s> \r\n< \t\t</ipsec> \r\n< \t</response>\r\nTunnel timeout (rekey interval) is 180 minutes.\r\nTCP_INFO rcv mss 1460, snd mss 1460, adv mss 1460, pmtu 1500\r\nNo MTU received. Calculated 1422 for ESP tunnel\r\nPOST https://<gp_gateway_name>/ssl-vpn/hipreportcheck.esp\r\n> POST /ssl-vpn/hipreportcheck.esp HTTP/1.1\r\n> Host: <gp_gateway_name>\r\n> User-Agent: PAN GlobalProtect\r\n> Cookie: PHPSESSID=<PHPSESSID>\r\n> X-Pad: 0000000000000000000000000000000000000\r\n> Content-Type: application/x-www-form-urlencoded\r\n> Content-Length: 219\r\n> \r\n> client-role=global-protect-full&authcookie=<cookie>&portal=Client_gateway_split-N&user=<gp_user_name>&domain=<user_domain>&computer=<local_computer_name>&client-ip=<user_ip>&md5=9186c68981cdeae3e747fc387224189a\r\nGot HTTP response: HTTP/1.1 200 OK\r\nDate: Wed, 02 May 2018 14:42:28 GMT\r\nContent-Type: application/xml; charset=UTF-8\r\nContent-Length: 107\r\nConnection: keep-alive\r\nETag: \"faccf-6a6-5a3ffe8f\"\r\nX-Content-Type-Options: nosniff\r\nPragma: no-cache\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nContent-Security-Policy: default-src 'self'\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nX-FRAME-OPTIONS: DENY\r\nHTTP body length:  (107)\r\n< \r\n< \t<response status=\"success\">\r\n< \t\t<hip-report-needed>yes</hip-report-needed>\r\n< \t\t<delay>0</delay>\r\n< \t</response>\r\nGateway says HIP report submission is needed.\r\nPOST https://<gp_gateway_name>/ssl-vpn/hipreport.esp\r\n> POST /ssl-vpn/hipreport.esp HTTP/1.1\r\n> Host: <gp_gateway_name>\r\n> User-Agent: PAN GlobalProtect\r\n> Cookie: PHPSESSID=<PHPSESSID>\r\n> X-Pad: 0000000000000000000000000000000\r\n> Content-Type: application/x-www-form-urlencoded\r\n> Content-Length: 7265\r\n> \r\n> client-role=global-protect-full&authcookie=<cookie>&portal=Client_gateway_split-N&user=<gp_user_name>&domain=<user_domain>&computer=<local_computer_name>&client-ip=<user_ip>&report=<hip_report>\r\nGot HTTP response: HTTP/1.1 200 OK\r\nDate: Wed, 02 May 2018 14:42:28 GMT\r\nContent-Type: application/xml; charset=UTF-8\r\nContent-Length: 75\r\nConnection: keep-alive\r\nETag: \"facce-632-5a3ffe8f\"\r\nX-Content-Type-Options: nosniff\r\nPragma: no-cache\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nContent-Security-Policy: default-src 'self'\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nX-FRAME-OPTIONS: DENY\r\nHTTP body length:  (75)\r\n< \r\n< \t<response status=\"success\">\r\n< \t\t<notification></notification>\r\n< \t</response>\r\nHIP report submitted successfully.\r\nParameters for incoming ESP: SPI <spi>\r\nESP encryption type AES-128-CBC (RFC3602) key <key>\r\nESP authentication type HMAC-SHA-1-96 (RFC2404) key <key>\r\nParameters for outgoing ESP: SPI <spi>\r\nESP encryption type AES-128-CBC (RFC3602) key <key>\r\nESP authentication type HMAC-SHA-1-96 (RFC2404) key <key>\r\nSend ESP probes\r\nConnected as <user_ip>, using SSL\r\n\r\n\r\n```\r\n"}}
{"actor":{"display_login":"dlenski"}}