Bug 1820906

Summary: NetworkManager-fortisslvpn overwrites /etc/resolv.conf
Product: [Fedora] Fedora Reporter: Tomas Kovar <tomas>
Component: NetworkManager-fortisslvpnAssignee: Simone Caronni <negativo17>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 31CC: bgalvani, fgiudici, lkundrak, negativo17, thaller
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: NetworkManager-fortisslvpn-1.3.90-7.fc32 NetworkManager-fortisslvpn-1.2.10-4.fc30 NetworkManager-fortisslvpn-1.3.90-7.fc31 NetworkManager-fortisslvpn-1.2.8-7.el7 NetworkManager-fortisslvpn-1.2.10-4.el8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-04-25 02:23:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Fix for /etc/resolv.conf overwriting none

Description Tomas Kovar 2020-04-04 15:12:56 UTC 
Description of problem:

Upon establishing VPN connection, overwrites /etc/resolv.conf.

When using NetworkManager's dnsmasq backend, this will break user's DNS. In the case that the gateway on the other end of the connection is not default gateway and the DNS server at the other end resolves only local zone, then it break users access to the Internet entirely.

It happens even with ipv[4,6].ignore-auto-dns=yes.

Version-Release number of selected component (if applicable):

NetworkManager-fortisslvpn-1.3.90-4

How reproducible:

Steps to Reproduce:
1. Configure VPN connection (gateway, username, password)
2. Dial VPN connection

Actual results:

1. The /etc/resolv.conf contains 'nameserver' and 'search' entries inserted at the top of NM-generated /etc/resolv.conf
2. The running openfortivpn process has been lanunched with '--pppd-use-peerdns=1' option

Expected results:

1. The DNS information pushed by the VPN gateway should be in the NM connection properties (ipv[4,6].dns.*)
2. That DNS information should be handled by NetworkManager, as other VPNs (l2pt, openvpn, wireguard, etc.) do.

Additional info:


The /etc/resolv.conf should not be overwritten by random processes; it should be handled by single owner only. In the case of NetworkManager (as this is case of NM plugin), NetworkManager itself should be that owner.
Comment 1 Tomas Kovar 2020-04-04 20:33:43 UTC 
Created attachment 1676257 [details]
Fix for /etc/resolv.conf overwriting
Comment 2 Tomas Kovar 2020-04-04 20:39:42 UTC 
Ok, so the issue is the patch that's in the 1.3.90-4 rpm.

It removes the '--no-dns' option, and adds '--pppd-use-peerdns=1'. While the second is needed, so that the ppppd plugin can relay the DNS info to NetworkManager, removing the first option causes the openfortivpn to default to '--set-dns=1', and to overwrite `/etc/resolv.conf`.

The attached patch keeps the first option and adds the second. It does that conditionally, so the ignore-auto-dns option is respected.

It was also submitted upstream at https://gitlab.gnome.org/GNOME/NetworkManager-fortisslvpn/-/merge_requests/15.
Comment 3 Simone Caronni 2020-04-15 07:53:55 UTC 
https://src.fedoraproject.org/rpms/NetworkManager-fortisslvpn/c/3517525da74d6adb08643a756066cd05a4722032?branch=master
Comment 4 Fedora Update System 2020-04-15 07:55:05 UTC 
FEDORA-EPEL-2020-0aff0a0cca has been submitted as an update to Fedora EPEL 8. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-0aff0a0cca
Comment 5 Fedora Update System 2020-04-15 07:55:06 UTC 
FEDORA-EPEL-2020-b243b0dcb6 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-b243b0dcb6
Comment 6 Fedora Update System 2020-04-15 07:55:06 UTC 
FEDORA-2020-c0388bdbd5 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2020-c0388bdbd5
Comment 7 Fedora Update System 2020-04-15 07:55:07 UTC 
FEDORA-2020-de1078f994 has been submitted as an update to Fedora 32. https://bodhi.fedoraproject.org/updates/FEDORA-2020-de1078f994
Comment 8 Fedora Update System 2020-04-15 07:55:08 UTC 
FEDORA-2020-eacbf2f402 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2020-eacbf2f402
Comment 9 Fedora Update System 2020-04-15 19:57:57 UTC 
FEDORA-2020-eacbf2f402 has been pushed to the Fedora 31 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-eacbf2f402`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-eacbf2f402

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 10 Fedora Update System 2020-04-15 21:19:31 UTC 
FEDORA-EPEL-2020-b243b0dcb6 has been pushed to the Fedora EPEL 7 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-b243b0dcb6

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 11 Fedora Update System 2020-04-15 21:40:21 UTC 
FEDORA-2020-c0388bdbd5 has been pushed to the Fedora 30 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-c0388bdbd5`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-c0388bdbd5

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 12 Fedora Update System 2020-04-15 22:52:31 UTC 
FEDORA-EPEL-2020-0aff0a0cca has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-0aff0a0cca

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 13 Fedora Update System 2020-04-16 19:28:11 UTC 
FEDORA-2020-de1078f994 has been pushed to the Fedora 32 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-de1078f994`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-de1078f994

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 14 Fedora Update System 2020-04-25 02:23:08 UTC 
FEDORA-2020-de1078f994 has been pushed to the Fedora 32 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 15 Fedora Update System 2020-04-25 02:42:30 UTC 
FEDORA-2020-c0388bdbd5 has been pushed to the Fedora 30 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 16 Fedora Update System 2020-04-25 03:00:48 UTC 
FEDORA-2020-eacbf2f402 has been pushed to the Fedora 31 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 17 Fedora Update System 2020-04-30 00:48:13 UTC 
FEDORA-EPEL-2020-b243b0dcb6 has been pushed to the Fedora EPEL 7 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 18 Fedora Update System 2020-05-01 00:35:18 UTC 
FEDORA-EPEL-2020-0aff0a0cca has been pushed to the Fedora EPEL 8 stable repository.
If problem still persists, please make note of it in this bug report.