Bug 2189594

Summary: Default F38 OpenVPN package does not work connecting to Azure OpenVPN Network Gateway.
Product: [Fedora] Fedora Reporter: Kevin B. Burns <kevin.b.burns>
Component: openvpnAssignee: David Sommerseth <dazo>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 38CC: adam.boseley, dazo, huzaifas, klember, steve
Target Milestone: ---Keywords: Desktop, Regression, Security
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
OpenVPN client config file none

Description Kevin B. Burns 2023-04-25 16:15:14 UTC 
I tried using both TCP and UDP. I compiled the DCO module with no luck. I regenerated the CA and client keys within F38 and, uploaded them to the Azure portal, regenerated the OpenVPN config script, but still nothing. I resolved to downgrade to the F37 OpenVPN package (OpenVPN-2.5.9-1.fc37) and restart Network Manager, and I could connect. In F38, it connects, initiates the connection, then loops in a reset connection panic.

Reproducible: Always

Steps to Reproduce:
1. Upgrade F37 to F38
2. Use the same OpenVPN script for connecting that worked previously.
3. Endless connection reset loop.

Actual Results:  
An endless loop of connection reset. The connection appears successful and binds but constantly resets almost immediately.

Expected Results:  
After a successful handshake/connection, I could access the resources in my Azure resource group and protected vnets.

When I Downgrade to OpenVPN-2.5.9-1.fc37 and restart NewtworkManager, I am able to connect using the same OpenVPN configuration without issue. It works both on the CLI and within GNome's OpenVPN manager.
Comment 1 Ferry Huberts 2023-04-26 20:36:41 UTC 
Created attachment 1960241 [details]
OpenVPN client  config file
Comment 2 Ferry Huberts 2023-04-26 20:37:59 UTC 
blast, attached the file to the wrong bug.
sorry!
please remove it
Comment 3 David Sommerseth 2023-04-28 12:04:25 UTC 
Can you please try to start the connection from the command line directly, set the log level (--verb) to 4 and provide the output of that?

Also might be worth a shot to try to connect using --disable-dco in the configs too, just to see if it is DCO related or not.  If disabling DCO enables the connection, please try to set SELinux into permissive mode and see if that works with DCO.  These are just a few potential areas I can imagine.