Incorrect route with OpenVPN plugin

[John Spray <jcspray icculus org>]

Hi,

I'm connecting to a VPN using NetworkManager 0.6.4 on ubuntu 7.04, but
it's not picking up the gateway correctly -- after NM connects to the
VPN I have to do a "route add -net 172.16.200.0 netmask 255.255.255.0 gw
172.16.220.1" before it works correctly.  The route NM initially creates
for the 172.16.0.0 range specifies no gateway.

I have attached logs from daemon.log when NM fails, and from the command
line output from the successful OpenVPN initialisation.  Note that the
OpenVPN log shows:

PUSH: Received control message: 'PUSH_REPLY,route-gateway 172.16.220.1 ...

Whereas the NM output does not.

Any suggestions?

Regards,
John

May 23 14:18:26 localhost nm-openvpn[2481]: OpenVPN 2.0.9 i486-pc-linux-gnu [SSL] [LZO] [EPOLL] built on Mar  2 2007
May 23 14:18:26 localhost NetworkManager: <information>^IVPN Activation (remote-network) Stage 3 of 4 (Connect) reply received. 
May 23 14:18:26 localhost NetworkManager: <information>^IVPN Activation (remote-network) Stage 4 of 4 (IP Config Get) timeout scheduled... 
May 23 14:18:26 localhost NetworkManager: <information>^IVPN Activation (remote-network) Stage 3 of 4 (Connect) complete, waiting for IP configuration... 
May 23 14:18:26 localhost nm-openvpn[2481]: Control Channel Authentication: using [REMOVED -jcs]
May 23 14:18:26 localhost nm-openvpn[2481]: UDPv4 link local: [undef]
May 23 14:18:26 localhost nm-openvpn[2481]: UDPv4 link remote: [REMOVED -jcs]
May 23 14:18:27 localhost nm-openvpn[2481]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1573', remote='link-mtu 1574'
May 23 14:18:27 localhost nm-openvpn[2481]: WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
May 23 14:18:27 localhost nm-openvpn[2481]: [remote-networkaccess.dyndns.org] Peer Connection Initiated with [REMOVED -jcs]
May 23 14:18:28 localhost nm-openvpn[2481]: TUN/TAP device tap0 opened
May 23 14:18:28 localhost nm-openvpn[2481]: ifconfig tap0 172.16.220.26 netmask 255.255.255.0 mtu 1500 broadcast 172.16.220.255
May 23 14:18:28 localhost avahi-daemon[4661]: Joining mDNS multicast group on interface tap0.IPv4 with address 172.16.220.26.
May 23 14:18:28 localhost avahi-daemon[4661]: New relevant interface tap0.IPv4 for mDNS.
May 23 14:18:28 localhost avahi-daemon[4661]: Registering new address record for 172.16.220.26 on tap0.IPv4.
May 23 14:18:28 localhost avahi-daemon[4661]: Withdrawing address record for 172.16.220.26 on tap0.
May 23 14:18:28 localhost avahi-daemon[4661]: Leaving mDNS multicast group on interface tap0.IPv4 with address 172.16.220.26.
May 23 14:18:28 localhost avahi-daemon[4661]: Interface tap0.IPv4 no longer relevant for mDNS.
May 23 14:18:28 localhost avahi-daemon[4661]: Joining mDNS multicast group on interface tap0.IPv4 with address 172.16.220.26.
May 23 14:18:28 localhost avahi-daemon[4661]: New relevant interface tap0.IPv4 for mDNS.
May 23 14:18:28 localhost avahi-daemon[4661]: Registering new address record for 172.16.220.26 on tap0.IPv4.
May 23 14:18:28 localhost nm-openvpn[2481]: /usr/lib/network-manager-openvpn/nm-openvpn-service-openvpn-helper tap0 1500 1573 172.16.220.26 255.255.255.0 init
May 23 14:18:28 localhost NetworkManager: <information>^IVPN Activation (remote-network) Stage 4 of 4 (IP Config Get) reply received. 
May 23 14:18:28 localhost nm-openvpn[2481]: Initialization Sequence Completed

Wed May 23 15:12:53 2007 us=437555 OpenVPN 2.0.9 i486-pc-linux-gnu [SSL] [LZO] [EPOLL] built on Mar  2 2007
Wed May 23 15:12:53 2007 us=440303 Control Channel Authentication: using 'remote-network.key' as a OpenVPN static key file
Wed May 23 15:12:53 2007 us=440363 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 23 15:12:53 2007 us=440403 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 23 15:12:53 2007 us=440469 LZO compression initialized
Wed May 23 15:12:53 2007 us=440692 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed May 23 15:12:53 2007 us=459058 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed May 23 15:12:53 2007 us=459208 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Wed May 23 15:12:53 2007 us=459241 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Wed May 23 15:12:53 2007 us=459323 Local Options hash (VER=V4): '13a273ba'
Wed May 23 15:12:53 2007 us=459377 Expected Remote Options hash (VER=V4): '360696c5'
Wed May 23 15:12:53 2007 us=459440 Socket Buffers: R=[110592->131072] S=[110592->131072]
Wed May 23 15:12:53 2007 us=459483 UDPv4 link local: [undef]
Wed May 23 15:12:53 2007 us=459518 UDPv4 link remote: [REMOVED - jcs]
Wed May 23 15:12:53 2007 us=510275 TLS: Initial packet from [REMOVED - jcs]
Wed May 23 15:12:53 2007 us=798419 VERIFY OK: [REMOVED - jcs]
Wed May 23 15:12:53 2007 us=799212 VERIFY OK: nsCertType=SERVER
Wed May 23 15:12:53 2007 us=799248 VERIFY OK: [REMOVED - jcs]
Wed May 23 15:12:54 2007 us=328404 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed May 23 15:12:54 2007 us=328495 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 23 15:12:54 2007 us=328719 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed May 23 15:12:54 2007 us=328756 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 23 15:12:54 2007 us=328896 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed May 23 15:12:54 2007 us=328972 [remote-network.dyndns.org] Peer Connection Initiated with [REMOVED -jcs]
Wed May 23 15:12:55 2007 us=402568 SENT CONTROL [remote-network.dyndns.org]: 'PUSH_REQUEST' (status=1)
Wed May 23 15:12:55 2007 us=456589 PUSH: Received control message: 'PUSH_REPLY,route-gateway 172.16.220.1,route 172.16.200.0 255.255.255.0,route 172.16.203.0 255.255.255.0,dhcp-option DOMAIN [REMOVED - jcs]
Wed May 23 15:12:55 2007 us=456835 OPTIONS IMPORT: timers and/or timeouts modified
Wed May 23 15:12:55 2007 us=456868 OPTIONS IMPORT: --ifconfig/up options modified
Wed May 23 15:12:55 2007 us=456894 OPTIONS IMPORT: route options modified
Wed May 23 15:12:55 2007 us=456919 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed May 23 15:12:55 2007 us=457551 TUN/TAP device tap0 opened
Wed May 23 15:12:55 2007 us=457607 TUN/TAP TX queue length set to 100
Wed May 23 15:12:55 2007 us=457667 ifconfig tap0 172.16.220.26 netmask 255.255.255.0 mtu 1500 broadcast 172.16.220.255
Wed May 23 15:12:55 2007 us=531516 route add -net 172.16.200.0 netmask 255.255.255.0 gw 172.16.220.1
Wed May 23 15:12:55 2007 us=537796 route add -net 172.16.203.0 netmask 255.255.255.0 gw 172.16.220.1
Wed May 23 15:12:55 2007 us=543873 Initialization Sequence Completed
Wed May 23 15:13:00 2007 us=384373 event_wait : Interrupted system call (code=4)
Wed May 23 15:13:00 2007 us=384982 TCP/UDP: Closing socket
Wed May 23 15:13:00 2007 us=385037 route del -net 172.16.203.0 netmask 255.255.255.0
Wed May 23 15:13:00 2007 us=389067 route del -net 172.16.200.0 netmask 255.255.255.0
Wed May 23 15:13:00 2007 us=392676 Closing TUN/TAP interface
Wed May 23 15:13:00 2007 us=441660 SIGINT[hard,] received, process exiting