openconnect has trouble maintaining a VPN connection

Bug #1754601 reported by Michael Thayer
16
This bug affects 3 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Triaged
Medium
Unassigned
openconnect (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

Some time after upgrading to Bionic, I have found that openconnect has some trouble keeping a VPN connection open to our company VPN. Since openconnect in Bionic seems to be based on the same upstream release as in Artful I assume that the problem is more likely to be in the kernel, and the timing of when it started could fit the kernel upgrade from 4.13 to 4.15.. I regularly see this in the output:

SSL read error: Error in the pull function.; reconnecting.
SSL negotiation with <server>
SSL connection failure: The operation timed out
sleep 10s, remaining timeout 300s
SSL negotiation with <server>
SSL connection failure: The operation timed out
sleep 20s, remaining timeout 290
...

Interestingly I just now saw it recover from that problem for the first time I am aware of.

I know that it would make sense to test it with the old kernel, and I will try that some time (I don't reboot that often, and am not always on VPN). In the mean time, I am creating this report in the hope that it will ring some bell with someone.

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: openconnect 7.08-3
ProcVersionSignature: Ubuntu 4.15.0-10.11-generic 4.15.3
Uname: Linux 4.15.0-10-generic x86_64
ApportVersion: 2.20.8-0ubuntu10
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Fri Mar 9 10:25:56 2018
InstallationDate: Installed on 2017-10-24 (135 days ago)
InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Release amd64 (20171018)
SourcePackage: openconnect
UpgradeStatus: Upgraded to bionic on 2018-02-06 (30 days ago)
---
ApportVersion: 2.20.8-0ubuntu10
Architecture: amd64
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: michael 1608 F.... pulseaudio
 /dev/snd/controlC1: michael 1608 F.... pulseaudio
CurrentDesktop: ubuntu:GNOME
DistroRelease: Ubuntu 18.04
HibernationDevice: RESUME=UUID=701963f8-cca7-4480-b062-4d2d5006f10d
InstallationDate: Installed on 2017-10-24 (149 days ago)
InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Release amd64 (20171018)
MachineType: Dell Inc. Latitude E7440
Package: openconnect 7.08-3
PackageArchitecture: amd64
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-4.15.0-12-generic root=/dev/mapper/ubuntu--vg-root ro quiet splash
ProcVersionSignature: Ubuntu 4.15.0-12.13-generic 4.15.7
RelatedPackageVersions:
 linux-restricted-modules-4.15.0-12-generic N/A
 linux-backports-modules-4.15.0-12-generic N/A
 linux-firmware 1.173
Tags: wayland-session bionic wayland-session
Uname: Linux 4.15.0-12-generic x86_64
UpgradeStatus: Upgraded to bionic on 2018-02-06 (44 days ago)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo vboxusers
_MarkForUpload: True
dmi.bios.date: 02/02/2015
dmi.bios.vendor: Dell Inc.
dmi.bios.version: A14
dmi.board.name: 0WK2DM
dmi.board.vendor: Dell Inc.
dmi.chassis.type: 9
dmi.chassis.vendor: Dell Inc.
dmi.modalias: dmi:bvnDellInc.:bvrA14:bd02/02/2015:svnDellInc.:pnLatitudeE7440:pvr01:rvnDellInc.:rn0WK2DM:rvr:cvnDellInc.:ct9:cvr:
dmi.product.name: Latitude E7440
dmi.product.version: 01
dmi.sys.vendor: Dell Inc.

Revision history for this message
Michael Thayer (michael-thayer) wrote :
Revision history for this message
Michael Thayer (michael-thayer) wrote :

I tried it for a bit with the old Artful kernel without issues. As soon as I booted back into the Bionic 4.15 I was unable to connect to the VPN again. It might be worth mentioning that the Cisco VPN tool also failed to connect. I did not try that one with 4.13.

Revision history for this message
Michael Thayer (michael-thayer) wrote :

The Cisco tool has trouble with both kernels. openconnect has so far not had problems with 4.16rc6 from the mainline PPA. So it is only Bionic's 4.15 so far. Not tested with mainline PPA 4.15, but I can if that makes sense. I am guessing it is a heisenbug, but I might be wrong.

I posted to the openconnect mailing list[1], but no answer yet.

[1] http://lists.infradead.org/pipermail/openconnect-devel/2018-March/004795.html

Revision history for this message
Michael Thayer (michael-thayer) wrote :

No problems seen so far with 4.15.7-041507-generic either, after 25 minutes connected to the VPN. Sounds like it might be a problem in the Ubuntu changes to 4.15 after all.

affects: linux-meta (Ubuntu) → linux (Ubuntu)
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1754601

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Revision history for this message
Michael Thayer (michael-thayer) wrote : AlsaInfo.txt

apport information

tags: added: apport-collected
description: updated
Revision history for this message
Michael Thayer (michael-thayer) wrote : CRDA.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : CurrentDmesg.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : Dependencies.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : IwConfig.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : JournalErrors.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : Lspci.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : Lsusb.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : ProcCpuinfoMinimal.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : ProcEnviron.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : ProcInterrupts.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : ProcModules.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : PulseList.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : RfKill.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : UdevDb.txt

apport information

Revision history for this message
Michael Thayer (michael-thayer) wrote : WifiSyslog.txt

apport information

Changed in linux (Ubuntu):
status: Incomplete → Confirmed
Revision history for this message
Michael Thayer (michael-thayer) wrote :

The information I added today is rather relativised by the fact that today I am unable to reproduce the problem with the Ubuntu 4.15 kernels either. I will update this when (if?) it happens again.

Changed in linux (Ubuntu):
importance: Undecided → Medium
status: Confirmed → Triaged
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in openconnect (Ubuntu):
status: New → Confirmed
Revision history for this message
Sven N. (sq-sen) wrote :

I have a similar issue with a Pulse Secure VPN
After some time and usually after one or more hex dumps were displayed, I get the following

SSL read error: Error in the pull function.; reconnecting.
SSL negotiation with ...
Connected to HTTPS on ...
Got HTTP response: HTTP/1.1 101 Switching Protocols

After that the VPN isn't working anymore and I neet to reconnect.

OpenConnect version v8.05-1
Using GnuTLS. Features present: TPMv2, PKCS#11, RSA software token, HOTP software token, TOTP software token, Yubikey OATH, System keys, DTLS, ESP
Supported protocols: anyconnect (default), nc, gp, pulse

This version is included in Ubuntu 20.04.

Revision history for this message
Ingo Karkat (inkarkat) wrote :

I've encountered the same problem as Sven N. (https://bugs.launchpad.net/ubuntu/+source/openconnect/+bug/1754601/comments/24), with the same Ubuntu 20.04 and OpenConnect version v8.05-1. After a few minutes, the "SSL read error" and "HTTP/1.1 101 Switching Protocols" appear reproducibly, connected clients hang or abort, and I had to cancel and reconnect.

What helped for me was switching from

$ sudo openconnect --protocol=pulse ...

to

$ sudo openconnect --juniper ...

Which is odd, because my company's VPN is Pulse Secure?!

Revision history for this message
Dan Lenski (lenski) wrote :

I'm one of the OpenConnect developers.

This thread appears to be describing THREE SEPARATE PROBLEMS, which likely have nothing to do with Ubuntu's packaging specifically. Please submit bug reports at https://gitlab.com/openconnect/openconnect/-/issues.

@Ingo Karkat:

> What helped for me was switching from
>
> $ sudo openconnect --protocol=pulse ...
>
> to
>
> $ sudo openconnect --juniper ...
>
> Which is odd, because my company's VPN is Pulse Secure?!

All Pulse Secure VPNs are backwards-compatible with the Juniper protocol. The two protocols are completely different, and both are *terrible* messes… but our understanding of the Juniper protocol is more complete.

If you want to improve the Pulse protocol support, please contribute over at Gitlab.

Read https://www.infradead.org/openconnect/juniper.html for a bit more explanation.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.