Juniper Network Connect Tun

[Mario Schroen]

Hi,

i'm using Juniper Network Connect.
With kernel Version "3.19.0-15-generic" it stops working.

I the logfile of Network connect i saw:

"IP Packet too small 0"

I found a solution which also has implemented in Fedora:

http://www.unixgr.com/juniper-ncsvc-and-linux-3-19/
and fix:
https://bugzilla.kernel.org/show_bug.cgi?id=90901
---
ApportVersion: 2.17.2-0ubuntu1
Architecture: amd64
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC2: mschroen 2784 F.... pulseaudio
 /dev/snd/controlC1: mschroen 2784 F.... pulseaudio
 /dev/snd/controlC0: mschroen 2784 F.... pulseaudio
CurrentDesktop: Unity
DistroRelease: Ubuntu 15.04
HibernationDevice: RESUME=UUID=cd8793fc-8985-4125-99f8-aff20e7ef69f
InstallationDate: Installed on 2013-10-07 (566 days ago)
InstallationMedia: Ubuntu 13.04 "Raring Ringtail" - Release amd64 (20130424)
MachineType: LENOVO 20AY001DGE
NonfreeKernelModules: fglrx
Package: linux (not installed)
ProcFB:
 0 inteldrmfb
 1 radeondrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-3.19.0-15-generic root=/dev/mapper/vgubuntu-root ro quiet splash kopt=root=/dev/mapper/vgubuntu-root vt.handoff=7
ProcVersionSignature: Ubuntu 3.19.0-15.15-generic 3.19.3
RelatedPackageVersions:
 linux-restricted-modules-3.19.0-15-generic N/A
 linux-backports-modules-3.19.0-15-generic N/A
 linux-firmware 1.143
Tags: vivid
Uname: Linux 3.19.0-15-generic x86_64
UpgradeStatus: Upgraded to vivid on 2015-04-24 (3 days ago)
UserGroups: adm cdrom dip libvirtd lpadmin plugdev sambashare sudo vboxusers
_MarkForUpload: True
dmi.bios.date: 07/23/2013
dmi.bios.vendor: LENOVO
dmi.bios.version: J3ET32WW (1.09 )
dmi.board.asset.tag: Not Available
dmi.board.name: 20AY001DGE
dmi.board.vendor: LENOVO
dmi.board.version: Win8 Pro DPK TPG
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvrJ3ET32WW(1.09):bd07/23/2013:svnLENOVO:pn20AY001DGE:pvrThinkPadS3-S440:rvnLENOVO:rn20AY001DGE:rvrWin8ProDPKTPG:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 20AY001DGE
dmi.product.version: ThinkPad S3-S440
dmi.sys.vendor: LENOVO

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1448942

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Mario Schroen (ms193)]

apport information

[Joseph Salisbury (jsalisbury)]

I built a Vivid test kernel with a cherry-pick of commit 957f094. The test kernel can be downloaded from:

http://kernel.ubuntu.com/~jsalisbury/lp1448942/

Can you test this kernel and see if it resolves this bug?

Note you will need to install both the linux-image and linux-image-extra .deb packages.

[Pavel Lunin (plunin)]

Hi guys,

I got this same issue with NC.

user@plunin:~$ cat ./.juniper_networks/network_connect/ncsvc.log | grep too
20150427220703.541981 ncsvc[p28704.t28704] adapter.warn IP Packet too small 0 (adapter.cpp:141)
20150427220755.955647 ncsvc[p28951.t28951] adapter.warn IP Packet too small 0 (adapter.cpp:141)
20150428003627.122925 ncsvc[p2852.t2852] adapter.warn IP Packet too small 0 (adapter.cpp:141)
20150428003736.352448 ncsvc[p3118.t3118] adapter.warn IP Packet too small 0 (adapter.cpp:141)
20150428010024.767780 ncsvc[p4265.t4265] adapter.warn IP Packet too small 0 (adapter.cpp:141)

And I've just installed the kernel provided by Joseph, and yes it fixes the issue for me.

[Mario Schroen (ms193)]

Hi,

the fix from Joseph works for me.

Thanks a lot.

Kind Regards,

Mario Schroen

[FZ (sirfz)]

Yes, Juniper nc works with Joseph's patched kernel.

[Schlomo Schapiro (sschapiro)]

Any ETA on an updated kernel package for Vivid? We have about 100 users who cannot upgrade as long as this stays broken :-(

[Pavel Lunin (plunin)]

Just in case someone interested. Latest kernel update to 3.19.0-16-generic does not resolve the issue.

[Luis Henriques (henrix)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-vivid' to 'verification-done-vivid'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[FZ (sirfz)]

I've tested the -proposed kernel (3.19.0-17-generic) and it solves this issued. Changed tag to 'verification-done-vivid'.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.19.0-17.17

---------------
linux (3.19.0-17.17) vivid; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1452000

  [ Damien Lespiau ]

  * SAUCE: i915_bpo: drm/i915/skl: Fix stepping check for a couple of W/As
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Implement WaDisableVFUnitClockGating
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Add the INIT power domain to the MISC
    I/O power well
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Fix the CTRL typo in the DPLL_CRTL1
    defines
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Make the Misc I/O power well part of the
    PLLS domain
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Deinit/init the display at
    suspend/resume
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Change CDCLK behind PCU's back
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: gen6+ platforms support runtime PM
    - LP: #1449469

  [ Imre Deak ]

  * SAUCE: i915_bpo: drm/i915/gen9: fix PIPE_CONTROL flush for
    VS_INVALIDATE
    - LP: #1449469

  [ Leann Ogasawara ]

  * [Config] Set CONFIG_XEN_MAX_DOMAIN_MEMORY defaults

  [ Matt Roper ]

  * SAUCE: i915_bpo: drm/i915: Switch to full atomic helpers for plane
    updates/disable, take two
    - LP: #1449469

  [ Sonika Jindal ]

  * SAUCE: i915_bpo: drm/i915/skl: Allow universal planes to position
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Support for 90/270 rotation
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Add back HDMI translation table
    - LP: #1449469

  [ Stefan Bader ]

  * SAUCE: vesafb: Set mtrr:3 (write-combining) as default
    - LP: #1434581

  [ Timo Aaltonen ]

  * SAUCE: Call i915_bpo specific functions from the hda driver
    - LP: #1449464
  * SAUCE: i915_bpo: Use get_display_clock_speed
    - LP: #1449469
  * SAUCE: i915_bpo: Add a few register definitions
    - LP: #1449469

  [ Upstream Kernel Changes ]

  * Revert "sparc/PCI: Clip bridge windows to fit in upstream windows"
    - LP: #1446316
  * Revert "PM / hibernate: avoid unsafe pages in e820 reserved regions"
    - LP: #1446316
  * Revert "libceph: use memalloc flags for net IO"
    - LP: #1446316
  * Revert "net: Reset secmark when scrubbing packet"
    - LP: #1451996
  * ASoC: da732x: Fix control-less DAPM routes
    - LP: #1446316
  * ASoC: ak4671: Fix control-less DAPM routes
    - LP: #1446316
  * ASoC: sn95031: Fix control-less DAPM routes
    - LP: #1446316
  * ASoC: sgtl5000: remove useless register write clearing CHRGPUMP_POWERUP
    - LP: #1446316
  * ASoC: pcm1681: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: cs4271: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: es8238: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: wm8960: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: tas5086: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: wm8731: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: wm2000: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: wm8903: Fix wrong value referen...

[Kiall Mac Innes (kiall)]

Another confirmation that 3.19.0-17.17 resolves this issue, and has seemed to have no other ill effects on my system.

[Neal Gamradt (ngamradt-d)]

I just wanted to note that I was having the same problem in Ubuntu 15.04. I upgraded to the (currently) proposed 3.19.0-17-generic (3.19.0-17.17) kernel and the Juniper SSL client is now working as expected.

Thank you for getting this fixed. This would have been a serious issue for me.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.19.0-18.18

---------------
linux (3.19.0-18.18) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1456732

  [ Upstream Kernel Changes ]

  * Revert "drm/i915: remove intel_pipe_set_base() (v4)"
    - LP: #1453593

linux (3.19.0-17.17) vivid; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1452000

  [ Damien Lespiau ]

  * SAUCE: i915_bpo: drm/i915/skl: Fix stepping check for a couple of W/As
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Implement WaDisableVFUnitClockGating
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Add the INIT power domain to the MISC
    I/O power well
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Fix the CTRL typo in the DPLL_CRTL1
    defines
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Make the Misc I/O power well part of the
    PLLS domain
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Deinit/init the display at
    suspend/resume
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Change CDCLK behind PCU's back
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: gen6+ platforms support runtime PM
    - LP: #1449469

  [ Imre Deak ]

  * SAUCE: i915_bpo: drm/i915/gen9: fix PIPE_CONTROL flush for
    VS_INVALIDATE
    - LP: #1449469

  [ Leann Ogasawara ]

  * [Config] Set CONFIG_XEN_MAX_DOMAIN_MEMORY defaults

  [ Matt Roper ]

  * SAUCE: i915_bpo: drm/i915: Switch to full atomic helpers for plane
    updates/disable, take two
    - LP: #1449469

  [ Sonika Jindal ]

  * SAUCE: i915_bpo: drm/i915/skl: Allow universal planes to position
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Support for 90/270 rotation
    - LP: #1449469
  * SAUCE: i915_bpo: drm/i915/skl: Add back HDMI translation table
    - LP: #1449469

  [ Stefan Bader ]

  * SAUCE: vesafb: Set mtrr:3 (write-combining) as default
    - LP: #1434581

  [ Timo Aaltonen ]

  * SAUCE: Call i915_bpo specific functions from the hda driver
    - LP: #1449464
  * SAUCE: i915_bpo: Use get_display_clock_speed
    - LP: #1449469
  * SAUCE: i915_bpo: Add a few register definitions
    - LP: #1449469

  [ Upstream Kernel Changes ]

  * Revert "sparc/PCI: Clip bridge windows to fit in upstream windows"
    - LP: #1446316
  * Revert "PM / hibernate: avoid unsafe pages in e820 reserved regions"
    - LP: #1446316
  * Revert "libceph: use memalloc flags for net IO"
    - LP: #1446316
  * Revert "net: Reset secmark when scrubbing packet"
    - LP: #1451996
  * ASoC: da732x: Fix control-less DAPM routes
    - LP: #1446316
  * ASoC: ak4671: Fix control-less DAPM routes
    - LP: #1446316
  * ASoC: sn95031: Fix control-less DAPM routes
    - LP: #1446316
  * ASoC: sgtl5000: remove useless register write clearing CHRGPUMP_POWERUP
    - LP: #1446316
  * ASoC: pcm1681: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: cs4271: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: es8238: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: wm8960: Fix wrong value references for boolean kctl
    - LP: #1446316
  * ASoC: tas5086: Fix wrong value references for boolean kctl
    - ...

[François Jacques (francois-jacques)]

Weird. I'm using:

3.19.0-18-lowlatency #18-Ubuntu SMP PREEMPT Tue May 19 19:02:50 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

And I still get the problem reported. I'll try the generic kernel, but I have little hope that the issue is completely resolved.

[Mario Schroen (ms193)]

Hi,

on my Linux host 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux the fix work.

i tried it at least 2 times without no problem.

Cheers

[François Jacques (francois-jacques)]

Forget about my previous post (edit #31). I tried it with generic and with a previous (3.16) kernel. In both cases, ncsvc still failed at negotiating the tunnel although the authentication goes through just fine and the connection applet shows up.

Kernel 3.19.0-18.18 is likely ok, both lowlatency and generic.

Now if I could find what else broke ncsvc... *sigh*

[Alex Shkop (a-v-shkop)]

Issues seems to reproduce again after update to 16.10. Kernel 4.8.0-22-generic. Downgrading to 4.4.0-43 helped.

If some additional info is required, pls tell me how to get it.

[Alex Shkop (a-v-shkop)]

There's "Bad ip packet len" warning that I can see in pulsesvc logs that started to show up after upgrade:

20161017100453.916474 pulsesvc[p11643.t11643] session.info Tunnel setup done (session.cpp:574)
20161017100453.916580 pulsesvc[p11643.t11643] ipsec.info Creating UDP socket 10.1.1.64:0 (udp.cpp:45)
20161017100453.916598 pulsesvc[p11643.t11643] ipsec.info setting IP_PMTU_DISCOVER (0) (udp.cpp:242)
20161017100453.916616 pulsesvc[p11643.t11643] ipsec.info new ESP tunnel in:0x9BD4E0FD, out:0x993872A5 10.1.1.64:0 -> *.*.*.*:4500 (engine.cpp:481)
20161017100453.916626 pulsesvc[p11643.t11643] ipsec.info send kmp message 302 size 86 (tunnel.cpp:235)
20161017100453.916642 pulsesvc[p11643.t11643] ipsec.info IpsecEngine::setTunAdapter (nil) (engine.cpp:104)
20161017100453.916713 pulsesvc[p11643.t11643] pulsesvc.info received onConnect (pulsesvc.cpp:702)
20161017100453.916831 pulsesvc[p11643.t11643] adapter.warn Bad ip packet len 48 - should be 0 (adapter.cpp:184)

[Alex Shkop (a-v-shkop)]

This turned out to be an issue in juniper client. Newer version works find

[Aaron Peromsik (aperomsik)]

Unfortunately not everyone has access to a new version of the client. Would be nice if kernel compatibility with previous versions could be restored.