TUN kernel module (tun.ko) not available in lucid lynx standard kernel

[Marcel Schulte]

Binary package hint: linux-image-2.6.32-21-generic

The tun module, needed by most (all?) VPN connections, is not included in generic kernel image any more.

Searching for "tun.ko" via packages.ubuntu.com results in information file is only available in RT kernel and user-mode-linux. Until karmic koala the module was also available in generic image so VPN connections were possible.

Did you forget to enable tun/tap config in generic lucid kernel or does it "work as designed" and we (thew ubuntu users) have to use another kernel package to get VPN working from lucid lynx on?

Many thanks in advance!

Regards,
Marcel
---
AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.21.
Architecture: amd64
ArecordDevices:
 **** List of CAPTURE Hardware Devices ****
 card 0: Intel [HDA Intel], device 0: AD198x Analog [AD198x Analog]
   Subdevices: 1/1
   Subdevice #0: subdevice #0
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: nimda 1637 F.... pulseaudio
CRDA: Error: [Errno 2] No such file or directory
Card0.Amixer.info:
 Card hw:0 'Intel'/'HDA Intel at 0xee400000 irq 17'
   Mixer name : 'Analog Devices AD1981'
   Components : 'HDA:11d41981,17aa2060,00100200'
   Controls : 20
   Simple ctrls : 11
Card29.Amixer.info:
 Card hw:29 'ThinkPadEC'/'ThinkPad Console Audio Control at EC reg 0x30, fw 7FHT26WW-1.08'
   Mixer name : 'ThinkPad EC 7FHT26WW-1.08'
   Components : ''
   Controls : 2
   Simple ctrls : 1
Card29.Amixer.values:
 Simple mixer control 'Console',0
   Capabilities: pvolume pvolume-joined pswitch pswitch-joined penum
   Playback channels: Mono
   Limits: Playback 0 - 14
   Mono: Playback 3 [21%] [off]
DistroRelease: Ubuntu 10.04
EcryptfsInUse: Yes
HibernationDevice: RESUME=UUID=3a6da91e-25ea-497c-a64b-dd3441c44bd7
InstallationMedia: LucidNC 0.1
MachineType: LENOVO 0674GEG
Package: linux (not installed)
PccardctlIdent:
 Socket 0:
   no product info available
PccardctlStatus:
 Socket 0:
   no card
ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.32-21-generic root=UUID=63d8dda1-6a77-4f62-95bb-0b672b6b7b20 ro quiet splash
ProcEnviron:
 PATH=(custom, no user)
 LANG=de_DE.utf8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.32-21.32-generic 2.6.32.11+drm33.2
Regression: No
RelatedPackageVersions: linux-firmware 1.34
Reproducible: Yes
Tags: lucid kconfig needs-upstream-testing
Uname: Linux 2.6.32-21-generic x86_64
UserGroups:

dmi.bios.date: 11/01/2006
dmi.bios.vendor: LENOVO
dmi.bios.version: 7FET91WW (2.09 )
dmi.board.name: 0674GEG
dmi.board.vendor: LENOVO
dmi.board.version: Not Available
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvr7FET91WW(2.09):bd11/01/2006:svnLENOVO:pn0674GEG:pvrThinkPadZ61p:rvnLENOVO:rn0674GEG:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 0674GEG
dmi.product.version: ThinkPad Z61p
dmi.sys.vendor: LENOVO

[Jeremy Foshee (jeremyfoshee)]

Hi Marcel,

Please be sure to confirm this issue exists with the latest development release of Ubuntu. ISO CD images are available from http://cdimage.ubuntu.com/releases/ . If the issue remains, please run the following command from a Terminal (Applications->Accessories->Terminal). It will automatically gather and attach updated debug information to this report.

apport-collect -p linux 565856

Also, if you could test the latest upstream kernel available that would be great. It will allow additional upstream developers to examine the issue. Refer to https://wiki.ubuntu.com/KernelMainlineBuilds . Once you've tested the upstream kernel, please remove the 'needs-upstream-testing' tag. This can be done by clicking on the yellow pencil icon next to the tag located at the bottom of the bug description and deleting the 'needs-upstream-testing' text. Please let us know your results.

Thanks in advance.

    [This is an automated message. Apologies if it has reached you inappropriately; please just reply to this message indicating so.]

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[Marcel Schulte (schulte-marcel)]

apport information

[ds9 (stephane-lentz)]

People using VPN software indeed face this issue. See :
http://ubuntuforums.org/showthread.php?t=1459559&highlight=module+tun+aventail&page=3

This link mentions a work-around :

sudo apt-get install build-essential linux-headers-`uname -r`
mkdir faketun
cd faketun
echo -e "#include <linux/module.h>\nstatic int start__module(void) {return 0;}\nstatic void end__module(void){return;}\nmodule_init(start__module);\nmodule_exit(end__module);">tun.c
echo -e "obj-m += tun.o\nall:\n\tmake -C /lib/modules/\$(shell uname -r)/build/ M=\$(PWD) modules\nclean:\n\tmake -C /lib/modules/\$(shell uname -r)/build/ M=\$(PWD) clean\nclean-files := Module.symvers">Makefile
make
sudo install tun.ko /lib/modules/`uname -r`/kernel/net/tun.ko
sudo depmod -a
sudo modprobe tun

But clearly an updated package with tun.o needs to be released - as it is an important module which was provided in the past.

[Anil Gangolli (anil-busybuddha)]

Tun appears to be built in but modprobe tun (or the equivalent) fails and several VPN clients depend on it succeeding.

The workaround above seems to add a fake tun.ko module so that scripts and programs depending on modprobe tun (or the equivalent) succeeding work.

There may be a simpler solution by adding an alias.

[Marcel Schulte (schulte-marcel)]

In my case it seems as if the "fault" was not at kernel side but the Juniper VPN client not working with 64bit java systems at all.

I'll try the client software with 32bit Lucid Lynx in an virtualbox environment tomorrow and will report back if that works for me.

After having seen the builtin tun module I watched the Juniper Webclient behavior after logging in and found a Java process in my PS list - without any feedback from that process.

I think the 32bit Lucid will bring my solution as the modprobe check did not stop the main process - it did just give a warning that the probe did not succeed.

Don't know how other VPN clients behave but if this would be a problem for the client to run it should be fixed by the client vendor as it should be the (linux) user's choice how to provide a kernel functionality (as module or builtin) - as long as it's there.

As said I'll report tomorrow.

Marcel

[Marcel Schulte (schulte-marcel)]

Hi again,

I was able to test the 32bit version faster than thought and it works!

So at least the Juniper VPN client (I use v6.5) works with the generic kernel - but 32bit java only, not with 64bit.
The warning "modprobe for tun module failed" is still there but the client itself works as it should do.

This bug is resolved for me as it was a client problem, not a kernel one.

But maybe other users (with other VPN clients) still need a "real" module so the case should not be closed.

Marcel

[Phelps Williams (phelpsw)]

I am also using Juniper VPN client v6.5 on 32bit 10.04 with the suggested fake tun module specified above. With the fake tun module I no longer get the modprobe for tun module error. Although when attempting to connect, the vpn session immediately times out and I get a "Session timeout" prompt.

This definitely is a Juniper VPN client problem.

[kazersozet (kazersozet)]

I have the same symptom that Phelps Williams with my Ubuntu 4.10 32bits.

[Jeroen Hensing (hensing)]

For vtund (which we use for enterprise location to location tunneling ;) i'm encountering that you also need tun.ko...
Will try fake workaround later when time allows...

[Nodaki (mdbarbere)]

An updated package with tun.o needs to be released - as it is an important module which was provided in the past.

This problem and being unable to connect to Juniper SSL VPN without faking a tun module makes 10.04 an unsuitable OS for my laptop.

Michael Barbere

[Bimmo (bimmo2007)]

this TUN bug together with nvidia and nouveau bug and numerous other bug like issues with lucid truly make lucid one of the most unstable version of ubuntu I've experienced since dapper, it leads me and a lot of other people desperately scrambling for an OS that is enterprise ready, short of resorting to proprietary solutions. I guess back to testing opensuse and fedora...

[frodemt (frodemt)]

This is frustrating. What about Debian 5.0? Does it have this issue?

[P.Constantine (pconstantine)]

Confirmed for Checkpoint SSL Extender (SNX) newest version R71
Fake tun module solved the issue.

[Lin Min Chang (minchang-lin)]

I guess that another way is to fake tun.ko is to copy the dummy.ko as tun.ko, the step shall be like:
sudo install /lib/modules/`uname -r`/kernel/drivers/net/dummy.ko /lib/modules/`uname -r`/kernel/net/tun.ko
sudo depmod -a
modprobe tun

[P.Constantine (pconstantine)]

The following line in modprobe.conf should solve the issue for most installations, without the need for fake/dummy module:

install tun /bin/true

I think it should be a good practice to add such lines for all the modules that "go inside" kernel

[Sami Kosonen (skosonen)]

Appgate client (http://www.mindbright.se/) gets broken as well due to this issue.
Managed to fix it with the P.Constantine's workaround though.

[Phelps Williams (phelpsw)]

P.Constantine's workaround failed for me identically to the fake module approach. This resulted in the same session immediately times out with a "Session timeout" prompt, the same behavior I mentioned before.

I also built my own kernel with the tap tun driver built as a module. This resulted in the same behavior. It would appear there is something more significant broken with a Juniper v6.5 vpn client in the configuration my company is utilizing. After some basic digging around I could not locate any log files that might shed more light on the failure.

[Pan (pi2g)]

I verified that the workaround works fine to me to use Juniper network connect.

install tun /bin/true

This doc is very helpful to address the Juniper client issue http://mad-scientist.us/juniper.html

[Leann Ogasawara (leannogasawara)]

Based on comment #22 from the original bug reporter, I'm closing this as a bug against the kernel. Additionally for the actively developed Maverick kernel, the tun driver appears to be built into the kernel:

[Leann Ogasawara (leannogasawara)]

Meant to post the following in the above comment.

ogasawara@emiko:~/ubuntu-maverick/debian.master/config$ grep -rn "CONFIG_TUN=" *
amd64/config.common.amd64:220:CONFIG_TUN=y
armel/config.flavour.versatile:153:CONFIG_TUN=y
armel/config.flavour.omap:153:CONFIG_TUN=m
config.common.ports:3575:CONFIG_TUN=y
i386/config.common.i386:221:CONFIG_TUN=y

[mayleen (der-feindliche-spunk)]

I have the same issue on Ubuntu 10.04 32-bit with Juniper VPN client.

The workaround does the trick. But without it the Juniper client wont workt at all.