[Bug 2108860] Re: floating IP due to "route VPN_IP net_gateway" causes 60 second "Disallow float" in openvpn 2.6

[Bryce Harrington]

Walter, no problem actually you've already done the heavy lifting to
make this easy for us to handle the remainder.  I think my co-workers
are just impressed at your progress and seeing how much farther you
wanted to get into it.  :-)  And yes, the Ubuntu process is not as
smooth and familiar as github, unfortunately, but I think we can totally
take it from here if you've hit your limit.

Lukas and Jonas are correct that first step is packaging the patch
getting a Merge Proposal (MP) filed for questing, since things have to
land in -devel before SRUing.  I've created an MP for my co-workers to
review, here:

https://code.launchpad.net/~bryce/ubuntu/+source/openvpn/+git/openvpn/+merge/491615

I've also uploaded this package to a PPA, to verify it builds and so we
can test it:

    https://launchpad.net/~bryce/+archive/ubuntu/openvpn-fix-lp2108860

Again, nothing more you need to do from this point.  However if you'd
like to help it looks like the most useful next step would be to define
a paint-by-numbers "Test Plan".  As examples of successful past openvpn
SRUs, see the [Test Plan] sections for LP: #2086809, LP: #1868127, LP:
#1975574, and LP: #1934781.  We'll need something of a similar level of
detail for this bug.

Thanks again for reporting this issue and helping so much in carrying it
this far.

** Changed in: openvpn (Ubuntu Questing)
   Importance: Undecided => High

** Changed in: openvpn (Ubuntu Questing)
       Status: Triaged => In Progress

** Changed in: openvpn (Ubuntu Questing)
     Assignee: (unassigned) => Bryce Harrington (bryce)

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2108860

Title:
  floating IP due to "route VPN_IP net_gateway" causes 60 second
  "Disallow float" in openvpn 2.6

Status in OpenVPN:
  New
Status in openvpn package in Ubuntu:
  In Progress
Status in openvpn source package in Noble:
  Triaged
Status in openvpn source package in Oracular:
  Won't Fix
Status in openvpn source package in Plucky:
  Triaged
Status in openvpn source package in Questing:
  In Progress

Bug description:
  OpenVPN unjustly blocks a source IP switch immediately after
  connection setup.

  We're using a (different) VPN (main) with a default gateway;
  we connect to the target VPN (3.3.3.3) with source IP 2.2.2.2;
  once connected to targetVPN, targetVPN pushes its own IP 3.3.3.3 with net_gateway so we don't get VPN-in-VPN;
  this is detected as a floating IP by openvpn.
  With openvpn 2.5, this works flawlessly.

  But with openvpn 2.6, it's counted as a second connection, and we get
  "Disallow float to an address taken by another client
  1.1.1.1:sourcePort". This lasts for 60 seconds until "client-instance
  restarting", after which the second connection is finally allowed.

  During these 60 seconds, all traffic to/through targetVPN is
  disallowed.

  ----

  Upstream bug report: https://github.com/openvpn/openvpn/issues/704

  Upstream patch: https://www.mail-archive.com/openvpn-
  devel at lists.sourceforge.net/msg31495.html

  Patch against 2.6.12 (for Noble) attached.

  ----

  Walter Doekes
  OSSO B.V.

To manage notifications about this bug go to:
https://bugs.launchpad.net/openvpn/+bug/2108860/+subscriptions