NetworkManager receives two VPN nameserver addresses but sends only one to dnsmasq

Bug #1072899 reported by Glenn Coombs
34
This bug affects 11 people
Affects Status Importance Assigned to Milestone
network-manager-openvpn (Ubuntu)
Confirmed
Undecided
Unassigned
network-manager-vpnc (Ubuntu)
Triaged
Medium
Mathieu Trudel-Lapierre

Bug Description

I tried to report this bug using "ubuntu-bug dnsmasq-base" but that process repeatably crashes :-( I've filed a separate bug report on that issue but therefore there is no information automatically appended. The output of lsb_release -a is:

No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 12.04.1 LTS
Release: 12.04
Codename: precise

and I am happy to append any further information that may be required.

I connect to my work network via VPN. The config has been working well but stopped working recently. The symptoms were that the VPN connection still succeeded but that DNS lookups of machines on the VPN failed. I have these lines in the syslog:

Oct 29 20:47:11 mini NetworkManager[1071]: <info> Internal IP4 DNS: 192.168.15.221
Oct 29 20:47:11 mini NetworkManager[1071]: <info> Internal IP4 DNS: 192.168.5.221
Oct 29 20:47:11 mini NetworkManager[1071]: <info> DNS Domain: 'kl.imgtec.org'

which shows that 2 DNS servers were reported when the VPN connection was established. If I attempt to lookup the IP address of my machine:

% host glenn.kl.imgtec.org
;; connection timed out; no servers could be reached

then it times out. If I tell it to use the second server:

$ host glenn.kl.imgtec.org 192.168.5.221
Using domain server:
Name: 192.168.5.221
Address: 192.168.5.221#53
Aliases:

glenn.kl.imgtec.org has address 192.168.17.88

then it works as expected. It seems that the 15.221 server is down (I cannot ping it) but the 5.221 server is fine. I would have expected the DNS lookup to fall back to the second server when it failed to receive a reply from the first server instead of just giving up.

The nm-dns-dnsmasq.conf file only shows information relating to the 1st server - it seems to have totally ignored the 2nd server:

$ cat /var/run/nm-dns-dnsmasq.conf
server=/kl.imgtec.org/192.168.15.221
server=/79.168.192.in-addr.arpa/192.168.15.221
server=/200.9.192.in-addr.arpa/192.168.15.221
server=/5.168.192.in-addr.arpa/192.168.15.221
server=/6.168.192.in-addr.arpa/192.168.15.221
server=/7.168.192.in-addr.arpa/192.168.15.221
server=/14.168.192.in-addr.arpa/192.168.15.221
server=/15.168.192.in-addr.arpa/192.168.15.221

--
Glenn
---
ApportVersion: 2.0.1-0ubuntu14
Architecture: i386
CRDA: Error: command ['iw', 'reg', 'get'] failed with exit code 1: nl80211 not found.
DistroRelease: Ubuntu 12.04
IfupdownConfig:
 auto lo
 iface lo inet loopback
InstallationMedia: Kubuntu 12.04 LTS "Precise Pangolin" - Release i386 (20120423)
NetworkManager.state:
 [main]
 NetworkingEnabled=true
 WirelessEnabled=true
 WWANEnabled=true
 WimaxEnabled=true
Package: network-manager 0.9.4.0-0ubuntu4.1
PackageArchitecture: i386
ProcEnviron:
 LANGUAGE=en_GB:en
 TERM=xterm
 PATH=(custom, user)
 LANG=en_GB.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 3.2.0-32.51-generic-pae 3.2.30
RfKill:

Tags: precise
Uname: Linux 3.2.0-32-generic-pae i686
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip disk lpadmin plugdev sambashare sudo vboxusers
WifiSyslog:

nmcli-con:
 NAME UUID TYPE TIMESTAMP TIMESTAMP-REAL AUTOCONNECT READONLY DBUS-PATH
 Wired connection 1 730f6f4e-d55a-4439-a6d9-ac5ccb495212 802-3-ethernet 1352109461 Mon 05 Nov 2012 09:57:41 GMT yes no /org/freedesktop/NetworkManager/Settings/2
 IMG 41f28d3f-9325-4801-8a99-cd0c8d479c13 vpn 1352109461 Mon 05 Nov 2012 09:57:41 GMT no no /org/freedesktop/NetworkManager/Settings/0
nmcli-dev:
 DEVICE TYPE STATE DBUS-PATH
 eth0 802-3-ethernet connected /org/freedesktop/NetworkManager/Devices/0
nmcli-nm:
 RUNNING VERSION STATE NET-ENABLED WIFI-HARDWARE WIFI WWAN-HARDWARE WWAN
 running 0.9.4.0 connected enabled enabled enabled enabled enabled

Revision history for this message
Thomas Hood (jdthood) wrote :

> I would have expected the DNS lookup to fall back to the second server when it failed to receive a reply from the first server instead of just giving up.

What is the output of "cat /etc/resolv.conf"?

What happens if you do "ping glenn.kl.imgtec.org"?

Revision history for this message
Glenn Coombs (glenn-coombs) wrote :

$ cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.0.1
search kl.imgtec.org

$ ping glenn.kl.imgtec.org
ping: unknown host glenn.kl.imgtec.org

Revision history for this message
Glenn Coombs (glenn-coombs) wrote :

I believe that you might be able to replicate this bug by setting up a vpn in "Automatic (VPN) addresses only" mode and specifying two DNS server addresses (one valid and one not). See attached image for example.

Revision history for this message
Simon Kelley (simon-thekelleys) wrote : Re: [Bug 1072899] [NEW] vpn dns server addresses - host lookups fail if first server is not reachable

On 29/10/12 21:50, Glenn Coombs wrote:
> The nm-dns-dnsmasq.conf file only shows information relating to the 1st
> server - it seems to have totally ignored the 2nd server:
>
> $ cat /var/run/nm-dns-dnsmasq.conf
> server=/kl.imgtec.org/192.168.15.221
> server=/79.168.192.in-addr.arpa/192.168.15.221
> server=/200.9.192.in-addr.arpa/192.168.15.221
> server=/5.168.192.in-addr.arpa/192.168.15.221
> server=/6.168.192.in-addr.arpa/192.168.15.221
> server=/7.168.192.in-addr.arpa/192.168.15.221
> server=/14.168.192.in-addr.arpa/192.168.15.221
> server=/15.168.192.in-addr.arpa/192.168.15.221
>

This would seem to indicate a network-manager problem, rather than one
with dnsmasq.

Simon.

Revision history for this message
Thomas Hood (jdthood) wrote : Re: Using NM and dnsmasq, although two nameserver addresses are provided for my VPN, host lookups fail if the first server is not reachable

Yes, it looks as if the problem is that NM is forgetting the second nameserver address.

Can you reproduce this malfunction with the Quantal version of network-manager?

affects: dnsmasq (Ubuntu) → network-manager (Ubuntu)
summary: - vpn dns server addresses - host lookups fail if first server is not
- reachable
+ Using NM and dnsmasq, although two nameserver addresses are provided for
+ my VPN, host lookups fail if the first server is not reachable
Revision history for this message
Glenn Coombs (glenn-coombs) wrote :

Can I install the Quantal version on my existing 12.04 install ? Or is that asking for trouble ?

If not I can install 12.10 onto a spare partition and try it out. Might take a couple of days though.

Revision history for this message
Glenn Coombs (glenn-coombs) wrote :

Just did a clean install of 12.10 to a spare partition and can confirm that it behaves exactly the same.

Revision history for this message
Thomas Hood (jdthood) wrote :

@Glenn: Please reboot, connect to network, connect to VPN, then run "apport-collect 1072899" to provide additional information about the affected machine.

Changed in network-manager (Ubuntu):
status: New → Incomplete
Revision history for this message
Glenn Coombs (glenn-coombs) wrote : Dependencies.txt

apport information

tags: added: apport-collected precise
description: updated
Revision history for this message
Glenn Coombs (glenn-coombs) wrote : IpAddr.txt

apport information

Revision history for this message
Glenn Coombs (glenn-coombs) wrote : IpRoute.txt

apport information

Revision history for this message
Glenn Coombs (glenn-coombs) wrote : IwConfig.txt

apport information

Revision history for this message
Glenn Coombs (glenn-coombs) wrote : NetDevice.eth0.txt

apport information

Revision history for this message
Glenn Coombs (glenn-coombs) wrote : NetDevice.lo.txt

apport information

Revision history for this message
Glenn Coombs (glenn-coombs) wrote : NetDevice.tun0.txt

apport information

Revision history for this message
Glenn Coombs (glenn-coombs) wrote : NetDevice.vboxnet0.txt

apport information

Revision history for this message
Glenn Coombs (glenn-coombs) wrote : NetworkManager.conf.txt

apport information

Revision history for this message
Glenn Coombs (glenn-coombs) wrote : PciNetwork.txt

apport information

Revision history for this message
Glenn Coombs (glenn-coombs) wrote : Re: Using NM and dnsmasq, although two nameserver addresses are provided for my VPN, host lookups fail if the first server is not reachable

As requested, please find attached the output from /var/log/syslog showing everything from startup to login.

Revision history for this message
Glenn Coombs (glenn-coombs) wrote :

And the output of "nmcli dev list" taken before activating the VPN.

Revision history for this message
Thomas Hood (jdthood) wrote :

@Glenn: Thanks for the information. I just looked at syslog.txt and it does not cover the action of establishing a VPN connection. Can you please post a longer syslog that does cover establishing a VPN connection? Then we can see the two nameserver addresses being received and sent to dnsmasq... or not.

Revision history for this message
Glenn Coombs (glenn-coombs) wrote :

Here you go. I have blanked out the IP address of the VPN gateway machine (xxx.xxx.xxx.xxx) but everything else is present. I see 2 nameserver addresses being reported but only the first one being used by dnsmasq.

Revision history for this message
Thomas Hood (jdthood) wrote :

@Glenn: Thanks for the additional info.

I am reassigning this to network-manager-vpnc. In the syslog submitted to bug #1013646 open against network-manager-vpnc we see the same phenomenon: NetworkManager receives the two nameserver addresses but sends only one to dnsmasq.

affects: network-manager (Ubuntu) → network-manager-vpnc (Ubuntu)
Changed in network-manager-vpnc (Ubuntu):
status: Incomplete → Confirmed
Revision history for this message
Thomas Hood (jdthood) wrote :

@Glenn: Can you work around the problem by disabling the local forwarding nameserver? Disable the local forwarding nameserver by commenting out the line "dns=dnsmasq" in /etc/NetworkManager/NetworkManager.conf; then run "sudo restart network-manager".

Thomas Hood (jdthood)
summary: - Using NM and dnsmasq, although two nameserver addresses are provided for
- my VPN, host lookups fail if the first server is not reachable
+ Using NM, vpnc and dnsmasq, although two nameserver addresses are
+ provided for my VPN, host lookups fail if the first server is not
+ reachable
Revision history for this message
Glenn Coombs (glenn-coombs) wrote : Re: Using NM, vpnc and dnsmasq, although two nameserver addresses are provided for my VPN, host lookups fail if the first server is not reachable

@Thomas: I have a workaround as described in post #3 where I manually specifiy the address of a working nameserver.

Revision history for this message
Thomas Hood (jdthood) wrote :

Thinking more about it, I figure that disabling the local forwarding nameserver will give you name service (because both nameserver addresses will be added to resolv.conf) but, so long as the first nameserver is offline, only after a five-second delay each time.

Thomas Hood (jdthood)
summary: - Using NM, vpnc and dnsmasq, although two nameserver addresses are
- provided for my VPN, host lookups fail if the first server is not
- reachable
+ NM-vpnc fails to process second nameserver address
Changed in network-manager-vpnc (Ubuntu):
status: Confirmed → Triaged
importance: Undecided → Medium
assignee: nobody → Mathieu Trudel-Lapierre (mathieu-tl)
Thomas Hood (jdthood)
summary: - NM-vpnc fails to process second nameserver address
+ NetworkManager receives two VPN nameserver addresses but sends only one
+ to dnsmasq
Revision history for this message
Thomas Hood (jdthood) wrote :

In bug #1169437 the submitter reports that "Additional DNS servers" included for the VPN connection are not sent to dnsmasq. I can confirm this.

Without "dns=dnsmasq", the additional addresses do get sent to resolvconf, however, and turn up in resolv.conf.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in network-manager-openvpn (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.