{"action":"created","issue":{"url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/580","repository_url":"https://api.github.com/repos/freifunk-berlin/firmware","labels_url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/580/labels{/name}","comments_url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/580/comments","events_url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/580/events","html_url":"https://github.com/freifunk-berlin/firmware/issues/580","id":346190130,"node_id":"MDU6SXNzdWUzNDYxOTAxMzA=","number":580,"title":"openvpn v2.4.5 is incompatible to our current tunnel-gateways","user":{"login":"pmelange","id":20710446,"node_id":"MDQ6VXNlcjIwNzEwNDQ2","avatar_url":"https://avatars0.githubusercontent.com/u/20710446?v=4","gravatar_id":"","url":"https://api.github.com/users/pmelange","html_url":"https://github.com/pmelange","followers_url":"https://api.github.com/users/pmelange/followers","following_url":"https://api.github.com/users/pmelange/following{/other_user}","gists_url":"https://api.github.com/users/pmelange/gists{/gist_id}","starred_url":"https://api.github.com/users/pmelange/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmelange/subscriptions","organizations_url":"https://api.github.com/users/pmelange/orgs","repos_url":"https://api.github.com/users/pmelange/repos","events_url":"https://api.github.com/users/pmelange/events{/privacy}","received_events_url":"https://api.github.com/users/pmelange/received_events","type":"User","site_admin":false},"labels":[{"id":869541187,"node_id":"MDU6TGFiZWw4Njk1NDExODc=","url":"https://api.github.com/repos/freifunk-berlin/firmware/labels/blocker","name":"blocker","color":"f24ddf","default":false},{"id":119436758,"node_id":"MDU6TGFiZWwxMTk0MzY3NTg=","url":"https://api.github.com/repos/freifunk-berlin/firmware/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/freifunk-berlin/firmware/milestones/9","html_url":"https://github.com/freifunk-berlin/firmware/milestone/9","labels_url":"https://api.github.com/repos/freifunk-berlin/firmware/milestones/9/labels","id":2834307,"node_id":"MDk6TWlsZXN0b25lMjgzNDMwNw==","number":9,"title":"Hedy-1.1.0","description":"working migration; current OpenWrt-release (something 18.06); 802.11s by default","creator":{"login":"bobster-galore","id":19499082,"node_id":"MDQ6VXNlcjE5NDk5MDgy","avatar_url":"https://avatars1.githubusercontent.com/u/19499082?v=4","gravatar_id":"","url":"https://api.github.com/users/bobster-galore","html_url":"https://github.com/bobster-galore","followers_url":"https://api.github.com/users/bobster-galore/followers","following_url":"https://api.github.com/users/bobster-galore/following{/other_user}","gists_url":"https://api.github.com/users/bobster-galore/gists{/gist_id}","starred_url":"https://api.github.com/users/bobster-galore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bobster-galore/subscriptions","organizations_url":"https://api.github.com/users/bobster-galore/orgs","repos_url":"https://api.github.com/users/bobster-galore/repos","events_url":"https://api.github.com/users/bobster-galore/events{/privacy}","received_events_url":"https://api.github.com/users/bobster-galore/received_events","type":"User","site_admin":false},"open_issues":24,"closed_issues":6,"state":"open","created_at":"2017-10-12T22:27:25Z","updated_at":"2018-08-19T12:02:43Z","due_on":null,"closed_at":null},"comments":18,"created_at":"2018-07-31T13:34:26Z","updated_at":"2018-08-21T09:53:08Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"This is happening on freshly installed and configured (through the wizard) tunnel-berlin images in \"master\" and \"SAm0815_experimental\".  This is possibly also an issue in other builds/branches, although I haven't tested them.\r\n\r\n* Upon startup, openvpn is not started automatically (noting related to openvpn in the logfile).\r\n* Running \"/etc/init.d/openvpn restart\" the following happens.\r\n```\r\n~# /etc/init.d/openvpn restart\r\nCommand failed: Not found\r\n```\r\n* After running the above command, openvpn _does_ start.  But it doesn't work properly.\r\n```\r\nTue Jul 31 14:50:11 2018 authpriv.info dropbear[2942]: Child connection from fdd2:4dde:2cc1::d43:40926\r\nTue Jul 31 14:50:12 2018 kern.notice kernel: [  105.382314] random: crng init done\r\nTue Jul 31 14:50:14 2018 authpriv.notice dropbear[2942]: Password auth succeeded for 'root' from fdd2:4dde:2cc1::d43:40926\r\nTue Jul 31 14:51:14 2018 daemon.notice openvpn(ffuplink)[2974]: OpenVPN 2.4.5 mips-openwrt-linux-gnu [SSL (mbed TLS)] [EPOLL] [AEAD]\r\nTue Jul 31 14:51:14 2018 daemon.notice openvpn(ffuplink)[2974]: library versions: mbed TLS 2.11.0\r\nTue Jul 31 14:51:14 2018 daemon.warn openvpn(ffuplink)[2974]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts\r\nTue Jul 31 14:51:14 2018 daemon.warn openvpn(ffuplink)[2974]: WARNING: failed to personalise random\r\nTue Jul 31 14:51:14 2018 daemon.warn openvpn(ffuplink)[2974]: ******* WARNING *******: '--cipher none' was specified. This means NO encryption will be performed and tunnelled data WILL be transmitted in clear text over the network! PLEASE DO RECONSIDER THIS SETTING!\r\nTue Jul 31 14:51:14 2018 daemon.notice openvpn(ffuplink)[2974]: TCP/UDP: Preserving recently used remote address: [AF_INET]217.197.83.193:1194\r\nTue Jul 31 14:51:14 2018 daemon.notice openvpn(ffuplink)[2974]: UDPv4 link local (bound): [AF_INET][undef]:1194\r\nTue Jul 31 14:51:14 2018 daemon.notice openvpn(ffuplink)[2974]: UDPv4 link remote: [AF_INET]217.197.83.193:1194\r\nTue Jul 31 14:51:15 2018 daemon.warn openvpn(ffuplink)[2974]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1525', remote='link-mtu 1526'\r\nTue Jul 31 14:51:15 2018 daemon.warn openvpn(ffuplink)[2974]: WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'\r\nTue Jul 31 14:51:15 2018 daemon.notice openvpn(ffuplink)[2974]: [freifunk-gw01.in-berlin.de] Peer Connection Initiated with [AF_INET]217.197.83.193:1194\r\nTue Jul 31 14:51:16 2018 daemon.notice netifd: Interface 'ffuplink' is enabled\r\nTue Jul 31 14:51:16 2018 daemon.notice netifd: Network device 'ffuplink' link is up\r\nTue Jul 31 14:51:16 2018 daemon.notice openvpn(ffuplink)[2974]: TUN/TAP device ffuplink opened\r\nTue Jul 31 14:51:16 2018 daemon.notice netifd: Interface 'ffuplink' has link connectivity\r\nTue Jul 31 14:51:16 2018 daemon.notice openvpn(ffuplink)[2974]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0\r\nTue Jul 31 14:51:16 2018 daemon.notice netifd: Interface 'ffuplink' is setting up now\r\nTue Jul 31 14:51:16 2018 daemon.notice openvpn(ffuplink)[2974]: /sbin/ifconfig ffuplink 172.31.241.61 netmask 255.255.255.0 mtu 1500 broadcast 172.31.241.255\r\nTue Jul 31 14:51:16 2018 daemon.notice netifd: Interface 'ffuplink' is now up\r\nTue Jul 31 14:51:16 2018 daemon.notice openvpn(ffuplink)[2974]: /lib/freifunk/ffvpn-up.sh ffuplink 1500 1552 172.31.241.61 255.255.255.0 init\r\nTue Jul 31 14:51:16 2018 user.debug up-down-ffvpn: no route_net_gateway env var from openvpn!\r\nTue Jul 31 14:51:16 2018 daemon.warn openvpn(ffuplink)[2974]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this\r\nTue Jul 31 14:51:16 2018 daemon.notice openvpn(ffuplink)[2974]: Initialization Sequence Completed\r\nTue Jul 31 14:51:18 2018 daemon.info modprobe: Usage: \tmodprobe [-q] filename\r\nTue Jul 31 14:51:18 2018 daemon.err modprobe: ifb is already loaded\r\nTue Jul 31 14:51:18 2018 daemon.err modprobe: cls_u32 is already loaded\r\nTue Jul 31 14:51:18 2018 daemon.err modprobe: em_u32 is already loaded\r\nTue Jul 31 14:51:18 2018 daemon.err modprobe: act_connmark is already loaded\r\nTue Jul 31 14:51:18 2018 daemon.err modprobe: act_mirred is already loaded\r\nTue Jul 31 14:51:18 2018 daemon.err modprobe: sch_ingress is already loaded\r\nTue Jul 31 14:51:18 2018 daemon.err modprobe: cls_fw is already loaded\r\nTue Jul 31 14:51:18 2018 daemon.err modprobe: sch_hfsc is already loaded\r\nTue Jul 31 14:51:19 2018 user.notice up-down-ffvpn: ugw: 192.168.1.1 dev: ffuplink remote: 255.255.255.0 gw: 172.31.241.1 src: 172.31.241.61 mask: 255.255.255.0\r\nTue Jul 31 14:51:19 2018 user.notice firewall: Reloading firewall due to ifup of ffuplink (ffuplink)\r\nTue Jul 31 14:51:19 2018 daemon.info olsrd_hotplug: [OK] ifup: 'ffuplink' => 'ffuplink'\r\nTue Jul 31 14:51:19 2018 daemon.debug olsrd_hotplug: [OK] interface 'ffuplink' => 'ffuplink' not used for olsrd\r\nTue Jul 31 14:51:20 2018 daemon.info olsrd_hotplug: [OK] ifup: 'ffuplink' => 'ffuplink'\r\nTue Jul 31 14:51:20 2018 daemon.debug olsrd_hotplug: [OK] interface 'ffuplink' => 'ffuplink' not used for olsrd6\r\nTue Jul 31 14:51:20 2018 user.notice ff-userlog: ffuplink interface is up\r\nTue Jul 31 14:51:20 2018 user.notice ff-userlog: creating ffuplink ip-rules\r\nTue Jul 31 14:51:20 2018 user.notice ff-userlog: UCI did not return a valid IP-net for ffuplink; querying directly with ip-tool\r\nTue Jul 31 14:51:20 2018 user.notice ff-userlog: ffuplink-interface is setup\r\nTue Jul 31 14:51:26 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:51:29 2018 daemon.err odhcp6c[1414]: Failed to send DHCPV6 message to ff02::1:2 (Permission denied)\r\nTue Jul 31 14:51:30 2018 daemon.warn odhcpd[994]: DHCPV6 RENEW IA_NA from 00041255ae230e49244278313f53c3a1f05f on br-dhcp: ok fdd2:4dde:2cc1::d43/128\r\nTue Jul 31 14:51:36 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:51:46 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:51:56 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:52:07 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:52:17 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:52:28 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:52:38 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:52:48 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:52:58 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:53:08 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\nTue Jul 31 14:53:42 2018 daemon.err odhcp6c[1414]: Failed to send DHCPV6 message to ff02::1:2 (Permission denied)\r\nTue Jul 31 14:54:00 2018 daemon.warn odhcpd[994]: DHCPV6 RENEW IA_NA from 00041255ae230e49244278313f53c3a1f05f on br-dhcp: ok fdd2:4dde:2cc1::d43/128\r\nTue Jul 31 14:54:08 2018 daemon.notice openvpn(ffuplink)[2974]: [freifunk-gw01.in-berlin.de] Inactivity timeout (--ping-restart), restarting\r\nTue Jul 31 14:54:08 2018 daemon.notice openvpn(ffuplink)[2974]: /sbin/ifconfig ffuplink 0.0.0.0\r\nTue Jul 31 14:54:08 2018 daemon.notice netifd: Network device 'ffuplink' link is down\r\nTue Jul 31 14:54:08 2018 daemon.notice netifd: Interface 'ffuplink' has link connectivity loss\r\nTue Jul 31 14:54:08 2018 daemon.notice netifd: Interface 'ffuplink' is now down\r\nTue Jul 31 14:54:08 2018 daemon.notice openvpn(ffuplink)[2974]: SIGUSR1[soft,ping-restart] received, process restarting\r\nTue Jul 31 14:54:08 2018 daemon.notice netifd: Interface 'ffuplink' is disabled\r\nTue Jul 31 14:54:08 2018 user.notice ff-userlog: ffuplink interface going down\r\nTue Jul 31 14:54:13 2018 daemon.warn openvpn(ffuplink)[2974]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts\r\nTue Jul 31 14:54:13 2018 daemon.notice openvpn(ffuplink)[2974]: TCP/UDP: Preserving recently used remote address: [AF_INET]217.197.83.193:1194\r\nTue Jul 31 14:54:13 2018 daemon.notice openvpn(ffuplink)[2974]: UDPv4 link local (bound): [AF_INET][undef]:1194\r\nTue Jul 31 14:54:13 2018 daemon.notice openvpn(ffuplink)[2974]: UDPv4 link remote: [AF_INET]217.197.83.193:1194\r\nTue Jul 31 14:54:14 2018 daemon.warn openvpn(ffuplink)[2974]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1525', remote='link-mtu 1526'\r\nTue Jul 31 14:54:14 2018 daemon.warn openvpn(ffuplink)[2974]: WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'\r\nTue Jul 31 14:54:14 2018 daemon.notice openvpn(ffuplink)[2974]: [freifunk-gw01.in-berlin.de] Peer Connection Initiated with [AF_INET]217.197.83.193:1194\r\nTue Jul 31 14:54:15 2018 daemon.notice netifd: Interface 'ffuplink' is enabled\r\nTue Jul 31 14:54:15 2018 daemon.notice netifd: Network device 'ffuplink' link is up\r\nTue Jul 31 14:54:15 2018 daemon.notice netifd: Interface 'ffuplink' has link connectivity\r\nTue Jul 31 14:54:15 2018 daemon.notice openvpn(ffuplink)[2974]: TUN/TAP device ffuplink opened\r\nTue Jul 31 14:54:15 2018 daemon.notice netifd: Interface 'ffuplink' is setting up now\r\nTue Jul 31 14:54:15 2018 daemon.notice openvpn(ffuplink)[2974]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0\r\nTue Jul 31 14:54:15 2018 daemon.notice openvpn(ffuplink)[2974]: /sbin/ifconfig ffuplink 172.31.241.61 netmask 255.255.255.0 mtu 1500 broadcast 172.31.241.255\r\nTue Jul 31 14:54:15 2018 daemon.notice netifd: Interface 'ffuplink' is now up\r\nTue Jul 31 14:54:15 2018 daemon.notice openvpn(ffuplink)[2974]: /lib/freifunk/ffvpn-up.sh ffuplink 1500 1552 172.31.241.61 255.255.255.0 init\r\nTue Jul 31 14:54:15 2018 user.debug up-down-ffvpn: no route_net_gateway env var from openvpn!\r\nTue Jul 31 14:54:15 2018 daemon.notice openvpn(ffuplink)[2974]: Initialization Sequence Completed\r\nTue Jul 31 14:54:17 2018 daemon.info modprobe: Usage: \tmodprobe [-q] filename\r\nTue Jul 31 14:54:17 2018 daemon.err modprobe: ifb is already loaded\r\nTue Jul 31 14:54:17 2018 daemon.err modprobe: cls_u32 is already loaded\r\nTue Jul 31 14:54:17 2018 daemon.err modprobe: em_u32 is already loaded\r\nTue Jul 31 14:54:17 2018 daemon.err modprobe: act_connmark is already loaded\r\nTue Jul 31 14:54:17 2018 daemon.err modprobe: act_mirred is already loaded\r\nTue Jul 31 14:54:17 2018 daemon.err modprobe: sch_ingress is already loaded\r\nTue Jul 31 14:54:17 2018 daemon.err modprobe: cls_fw is already loaded\r\nTue Jul 31 14:54:17 2018 daemon.err modprobe: sch_hfsc is already loaded\r\nTue Jul 31 14:54:17 2018 user.notice up-down-ffvpn: ugw: 192.168.1.1 dev: ffuplink remote: 255.255.255.0 gw: 172.31.241.1 src: 172.31.241.61 mask: 255.255.255.0\r\nTue Jul 31 14:54:18 2018 user.notice firewall: Reloading firewall due to ifup of ffuplink (ffuplink)\r\nTue Jul 31 14:54:18 2018 daemon.info olsrd_hotplug: [OK] ifup: 'ffuplink' => 'ffuplink'\r\nTue Jul 31 14:54:18 2018 daemon.debug olsrd_hotplug: [OK] interface 'ffuplink' => 'ffuplink' not used for olsrd\r\nTue Jul 31 14:54:18 2018 daemon.info olsrd_hotplug: [OK] ifup: 'ffuplink' => 'ffuplink'\r\nTue Jul 31 14:54:18 2018 daemon.debug olsrd_hotplug: [OK] interface 'ffuplink' => 'ffuplink' not used for olsrd6\r\nTue Jul 31 14:54:18 2018 user.notice ff-userlog: ffuplink interface is up\r\nTue Jul 31 14:54:18 2018 user.notice ff-userlog: creating ffuplink ip-rules\r\nTue Jul 31 14:54:18 2018 user.notice ff-userlog: UCI did not return a valid IP-net for ffuplink; querying directly with ip-tool\r\nTue Jul 31 14:54:19 2018 user.notice ff-userlog: ffuplink-interface is setup\r\nTue Jul 31 14:54:25 2018 daemon.err openvpn(ffuplink)[2974]: write to TUN/TAP : Invalid argument (code=22)\r\n```\r\n* The only difference in the options in /etc/config/openvpn between Hedy-1.0.1 and the master/SAm branches is that in Hedy-1.0.1 there is the following option\r\n```\r\noption local '192.168.1.4'\r\n```\r\n* After adding the \"local\" option, there is no difference.  Openvpn does not start automatically and manually starting has the same results as shown above."},"comment":{"url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/comments/414618845","html_url":"https://github.com/freifunk-berlin/firmware/issues/580#issuecomment-414618845","issue_url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/580","id":414618845,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNDYxODg0NQ==","user":{"login":"pmelange","id":20710446,"node_id":"MDQ6VXNlcjIwNzEwNDQ2","avatar_url":"https://avatars0.githubusercontent.com/u/20710446?v=4","gravatar_id":"","url":"https://api.github.com/users/pmelange","html_url":"https://github.com/pmelange","followers_url":"https://api.github.com/users/pmelange/followers","following_url":"https://api.github.com/users/pmelange/following{/other_user}","gists_url":"https://api.github.com/users/pmelange/gists{/gist_id}","starred_url":"https://api.github.com/users/pmelange/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmelange/subscriptions","organizations_url":"https://api.github.com/users/pmelange/orgs","repos_url":"https://api.github.com/users/pmelange/repos","events_url":"https://api.github.com/users/pmelange/events{/privacy}","received_events_url":"https://api.github.com/users/pmelange/received_events","type":"User","site_admin":false},"created_at":"2018-08-21T09:53:08Z","updated_at":"2018-08-21T09:53:08Z","author_association":"CONTRIBUTOR","body":"Having compression on the client->server and no compression on the server->client (and visa-versa) is a totally valid configuration.  The reason that it didn't work with the freifunk firmware, like I wrote above, is because of 087680a. \r\n\r\nIt is also possible to have the server push no compression to the clients after they connect.\r\n\r\nThe thing that is a problem is that I still can't figure out a way to have the clients do no compression.  Simply leaving out the compress option will not work.  I have tried various versions of the compress option, but I still haven't found one that works.\r\n\r\nSo, my suggestion is that we re-enable the ```CONFIG_OPENVPN_mbedtls_ENABLE_LZO``` compile option and have the server push no compression.  The downside is a bigger binary and dependency on liblzo.\r\n\r\nThis will be my last post until some time early Sept.  If someone else wants to take over this issue, that would be great.\r\n\r\nhttps://community.openvpn.net/openvpn/wiki/DeprecatedOptions\r\nhttps://community.openvpn.net/openvpn/ticket/952\r\nhttps://wiki.openwrt.org/inbox/vpn.howto"}}
{"actor":{"display_login":"pmelange"}}