#877696 Subject: /etc/openvpn/update-resolv-conf: /etc/openvpn/update-resolv-conf does not parse DNS option correctly

Package:
openvpn
Source:
openvpn
Description:
virtual private network daemon
Submitter:
Iliana Panagopoulou
Date:
2017-10-05 15:36:05 UTC
Severity:
normal
#877696#5
Date:
2017-10-04 13:10:26 UTC
From:
To:
Dear Maintainer,
executes resolvconf does not parse it correcty as it does not end in a
newline.
For this I changed "$R" to "$R\n" and it worked(on this senario my
server.conf had only one 'push dhcp-option DNS x.x.x.x")
(It also worked and pushed correctly 2 diffrent dhcp-options in this
senario, because I thought that maybe my solution would break adding
more dhcp-option, but it looks like it does not.)

I don't know if adding a "\n" could be a good solution.

Please inform me about the output of this bug report.

Thanks in advance,
Iliana.
#877696#10
Date:
2017-10-04 13:45:17 UTC
From:
To:
Hi Iliana,

When added server side, "push" is required for this option to be sent to
the client.

That's the right way to configure it as far as I know.

Regards,
Simon
#877696#15
Date:
2017-10-04 13:45:17 UTC
From:
To:
Hi Iliana,

When added server side, "push" is required for this option to be sent to
the client.

That's the right way to configure it as far as I know.

Regards,
Simon
#877696#20
Date:
2017-10-04 14:20:01 UTC
From:
To:
push "dhcp-option DNS X.X.X.X"

which didn't work so I started debugging the script only to find out
that the value passed to resolvconf wasn't acceptable due to the
lack of a newline at the "EOF"

In order to fix this by only performing changes server-side, I duplicated
the dhcp-option so that, from the two lines generated by update-resolv-conf
at least the first one would contain a newline.

so, in my server configuration I had:
push "dhcp-option DNS X.X.X.X"
push "dhcp-option DNS X.X.X.X"

which does not seem right to me.

Doing so, resolved the problem.

To reproduce this, you just need an OpenVPN installation that pushes a
single DNS server to its clients.
#877696#25
Date:
2017-10-04 14:20:01 UTC
From:
To:
push "dhcp-option DNS X.X.X.X"

which didn't work so I started debugging the script only to find out
that the value passed to resolvconf wasn't acceptable due to the
lack of a newline at the "EOF"

In order to fix this by only performing changes server-side, I duplicated
the dhcp-option so that, from the two lines generated by update-resolv-conf
at least the first one would contain a newline.

so, in my server configuration I had:
push "dhcp-option DNS X.X.X.X"
push "dhcp-option DNS X.X.X.X"

which does not seem right to me.

Doing so, resolved the problem.

To reproduce this, you just need an OpenVPN installation that pushes a
single DNS server to its clients.
#877696#30
Date:
2017-10-04 14:44:57 UTC
From:
To:
That's weird as the relevant line in the script does add a newline by
having the double quote closed on the next line:

        for NS in $NMSRVRS ; do
                R="${R}nameserver $NS
"
        done
        echo -n "$R" | /sbin/resolvconf -a "${dev}.openvpn"

In order to debug this further, would you mind running those commands
(as root) and share the output:

ls -l /etc/resolv.conf
for f in /etc/resolv.conf /run/resolvconf/interface/*; do
  echo "pre $(basename $f):"
  cat "$f"
done
TRUNCATE_NAMESERVER_LIST_AFTER_LOOPBACK_ADDRESS=no \
  foreign_option_1='dhcp-option DNS 4.2.2.1' \
  dev=tun0 script_type=up \
  /etc/openvpn/update-resolv-conf

for f in /etc/resolv.conf /run/resolvconf/interface/*; do
  echo "up $(basename $f):"
  cat "$f"
done

TRUNCATE_NAMESERVER_LIST_AFTER_LOOPBACK_ADDRESS=no \
  foreign_option_1='dhcp-option DNS 4.2.2.1' \
  dev=tun0 script_type=down \
  /etc/openvpn/update-resolv-conf

for f in /etc/resolv.conf /run/resolvconf/interface/*; do
  echo "down $(basename $f):"
  cat "$f"
done


Thanks,
Simon
#877696#35
Date:
2017-10-04 14:44:57 UTC
From:
To:
That's weird as the relevant line in the script does add a newline by
having the double quote closed on the next line:

        for NS in $NMSRVRS ; do
                R="${R}nameserver $NS
"
        done
        echo -n "$R" | /sbin/resolvconf -a "${dev}.openvpn"

In order to debug this further, would you mind running those commands
(as root) and share the output:

ls -l /etc/resolv.conf
for f in /etc/resolv.conf /run/resolvconf/interface/*; do
  echo "pre $(basename $f):"
  cat "$f"
done
TRUNCATE_NAMESERVER_LIST_AFTER_LOOPBACK_ADDRESS=no \
  foreign_option_1='dhcp-option DNS 4.2.2.1' \
  dev=tun0 script_type=up \
  /etc/openvpn/update-resolv-conf

for f in /etc/resolv.conf /run/resolvconf/interface/*; do
  echo "up $(basename $f):"
  cat "$f"
done

TRUNCATE_NAMESERVER_LIST_AFTER_LOOPBACK_ADDRESS=no \
  foreign_option_1='dhcp-option DNS 4.2.2.1' \
  dev=tun0 script_type=down \
  /etc/openvpn/update-resolv-conf

for f in /etc/resolv.conf /run/resolvconf/interface/*; do
  echo "down $(basename $f):"
  cat "$f"
done


Thanks,
Simon
#877696#40
Date:
2017-10-05 15:34:16 UTC
From:
To:
I'm surprised this points to /etc and not /run (or /var/run).

This is a bogus entry and I don't know how it ended up in there. Did
this occur with the original update-resolv-conf script?

This time it's good and /etc/resolv.conf was properly configured.

And /etc/resolv.conf is properly cleaned up when you "down" the connection.

So other than the weird glitch of "dhcp-option" showing up in
tun0.openvpn, everything looks sane.

Regards,
Simon