NetworkManager-openvpn mishandles the comp-lzo option, thereby breaking the ovpn config and causing AUTH_FAILED

[Forest]

Attempting to establish an OpenVPN session via network-manager-openvpn fails with a password authentication error, even though the username and password I entered are correct. The following messages in syslog:

    Feb 1 12:44:54 computer nm-openvpn[21582]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
    Feb 1 12:44:54 computer nm-openvpn[21582]: UDPv4 link local: [undef]
    Feb 1 12:44:54 computer nm-openvpn[21582]: UDPv4 link remote: [AF_INET]209.148.113.36:1194
    Feb 1 12:44:54 computer nm-openvpn[21582]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1557', remote='link-mtu 1558'
    Feb 1 12:44:54 computer nm-openvpn[21582]: WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
    Feb 1 12:44:54 computer nm-openvpn[21582]: [OpenVPN Server] Peer Connection Initiated with [AF_INET]209.148.113.36:1194
    Feb 1 12:44:56 computer nm-openvpn[21582]: AUTH: Received control message: AUTH_FAILED
    Feb 1 12:44:56 computer nm-openvpn[21582]: SIGUSR1[soft,auth-failure] received, process restarting
    Feb 1 12:44:56 computer NetworkManager[1322]: nm-openvpn[21574] <warn> Password verification failed

I am able to establish the session by manually running openvpn from the command line, using the same username, password, and the ovpn file from which NetworkManager imported the setttings.

I'm running Xubuntu 16.10 (yakkety).
I did not have this problem in Ubuntu 16.04 (xenial).

[Forest (foresto)]

NetworkManager 1.2.4
NetworkManager-openvpn 1.2.6 and 1.2.8 (same problem in both)

$ nmcli --version
nmcli tool, version 1.2.4

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.10
Release: 16.10
Codename: yakkety

$ openvpn --version
OpenVPN 2.3.11 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2016
library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <email address hidden>
Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=yes enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_maintainer_mode=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='${prefix}/lib/openvpn' with_sysroot=no

$ tail -f /var/log/syslog
Feb 2 23:49:01 computer NetworkManager[1329]: <info> [1486108141.0702] audit: op="connection-activate" uuid="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" name="example" pid=3136 uid=1000 result="success"
Feb 2 23:49:01 computer NetworkManager[1329]: <info> [1486108141.0741] vpn-connection[0x557d295f73c0,XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX,"example",0]: Started the VPN service, PID 5074
Feb 2 23:49:01 computer NetworkManager[1329]: <info> [1486108141.0828] vpn-connection[0x557d295f73c0,XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX,"example",0]: Saw the service appear; activating connection
Feb 2 23:49:01 computer nm-openvpn[5081]: OpenVPN 2.3.11 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2016
Feb 2 23:49:01 computer nm-openvpn[5081]: library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Feb 2 23:49:01 computer NetworkManager[1329]: nm-openvpn[5074] <info> openvpn[5081] started
Feb 2 23:49:01 computer NetworkManager[1329]: <info> [1486108141.1490] vpn-connection[0x557d295f73c0,XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX,"example",0]: VPN plugin: state changed: starting (3)
Feb 2 23:49:01 computer NetworkManager[1329]: <info> [1486108141.1491] vpn-connection[0x557d295f73c0,XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX,"example",0]: VPN connection: (ConnectInteractive) reply received
Feb 2 23:49:01 computer nm-openvpn[5081]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 2 23:49:01 computer nm-openvpn[5081]: Control Channel Authentication: using '/...

[Forest (foresto)]

Turns out is triggered by NetworkManager-openvpn stripping the "comp-lzo no" option from the imported .ovpn config file, misrepresenting a 3-value option as a simple check box, and giving the user no way to enter the correct setting.

Checking the "Use LZO data compression" box in the Advanced... config dialog *might* work around the problem. This does not map to the intended "comp-lzo no" setting in openvpn, but if the server is pushing the setting to the client, it might work anyway.

More details in the upstream bug report.