Bug 1250723 - Updating IPv4 address lifetime causes VPN disconnection
Summary: Updating IPv4 address lifetime causes VPN disconnection
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: NetworkManager
Version: 7.1
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Rashid Khan
QA Contact: Desktop QE
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-08-05 20:17 UTC by David Ward
Modified: 2015-11-19 11:02 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-11-19 11:02:47 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2315 normal SHIPPED_LIVE Moderate: NetworkManager security, bug fix, and enhancement update 2015-11-19 10:06:58 UTC

Description David Ward 2015-08-05 20:17:46 UTC
(Note: this is a separate but related issue to bug 1250705, which applies to the kernel.)

Please update from NetworkManager 1.0.0 to NetworkManager 1.0.4 in RHEL 7, to fix behavior that causes a standalone corporate VPN client to regularly disconnect when operating over a DHCP-enabled NetworkManager connection. (This does not occur with NetworkManager prior to 1.0, i.e., in RHEL 6.)

When the VPN client is started, it installs its own additional routes with a lower metric than existing routes to ensure that all traffic goes through the tunnel interface it creates. To enforce this, the VPN client monitors netlink for routing changes and disconnects immediately if any occur. When the DHCP lease on the NetworkManager connection is renewed and the address lifetime is updated, NetworkManager calls nm_platform_ip4_route_sync() and attempts to restore the routing table to its earlier state prior to starting the VPN client.

This is resolved in NetworkManager 1.0.4, which now attempts to preserve IP confiugration changes that are made outside of NetworkManager. From my examination of the code, this appears to have required substantial changes and so the minor version upgrade of NetworkManager is likely necessary to incorporate these into RHEL 7.

Comment 1 Thomas Haller 2015-08-05 20:30:20 UTC
RHEL-7.2 will contain 1.0.4 release + additional fixes (mostly from nm-1-0 upstream branch).

The current beta-builds for RHEL-7.2 already now contain 1.0.4+, so I think this BZ will be fixed (without need for further action). Yay.

Comment 2 David Ward 2015-08-05 20:36:51 UTC
Excellent! Thanks for the info.

Comment 4 Thomas Haller 2015-08-10 08:45:37 UTC
I am going to add this bug to errata, which eventually leads to the bug being closed (fixed).

The current RHEL-7.2 beta builds already contain 1.0.4+, so that part of the bug is certainly handled.

Presumably 1.0.4 also brings the desired behavior to fix this bug (i.e. play nice with external routes from other VPN clients).



Let's open a new (more specific bug) in case that 1.0.4 has other issues with respect to handling routes. But I'd expect that not to be necessary.

Comment 6 Vladimir Benes 2015-09-21 17:45:07 UTC
tested and working on 2 minutes dhcp connection

Comment 7 errata-xmlrpc 2015-11-19 11:02:47 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2315.html


Note You need to log in before you can comment on or make changes to this bug.