网络管理器中的 Openconnect 不更新 resolv.conf

Question

我刚刚从 ubuntu 19.10 更新到 ubuntu 20.04。现在，当我使用网络管理器中的 openconnect 连接到 vpn 时，我的 resolve.conf 不再更新。

这正常工作：

须藤 openconnect -u 用户https://server

我看到 resolv.conf 正在更改。所以是客户端的问题。

在 /etc/NetworkManager/NetworkManager.conf 我有 dns=none 来使用 resolv.conf

/etc/resolv.conf 是一个文件，没有符号链接到 /run/systemd/resolve/resolv.conf。我确实检查了 /run/systemd/resolve/resolv.conf 是否被任何东西更新，但这也没有得到更新。

这是来自系统日志：

NetworkManager[62862]: <info>  [1590658767.3686] vpn-connection[,"vpn",0]: VPN connection: (ConnectInteractive) reply received
NetworkManager[62862]: <info>  [1590658767.3714] vpn-connection[,"vpn",0]: VPN plugin: state changed: starting (3)
openconnect[63139]: Connected to somehostip:443
openconnect[63139]: SSL negotiation with somehostip
openconnect[63139]: Server certificate verify failed: signer not found
openconnect[63139]: Connected to HTTPS on somehostip 
openconnect[63139]: Got CONNECT response: HTTP/1.1 200 OK
openconnect[63139]: CSTP connected. DPD 30, Keepalive 20
openconnect[63139]: Connected as 10.0.0.2 + ipv6addresswashere, using SSL, with DTLS in progress
openconnect[63139]: Established DTLS connection (using GnuTLS). Ciphersuite (DTLS0.9)-(DHE-CUSTOM)-(AES-256-CBC)-(SHA1).
openconnect[63139]: SIOCSIFMTU: Operation not permitted
NetworkManager[62862]: <info>  [1590658768.5289] vpn-connection[,"vpn",0]: VPN connection: (IP Config Get) reply received.
NetworkManager[62862]: <info>  [1590658768.5320] vpn-connection[,"vpn",14:(vpn0)]: VPN connection: (IP4 Config Get) reply received
NetworkManager[62862]: <info>  [1590658768.5362] vpn-connection[,"vpn",14:(vpn0)]: VPN connection: (IP6 Config Get) reply received
NetworkManager[62862]: <info>  [1590658768.5373] vpn-connection[,"vpn",14:(vpn0)]: Data: VPN Gateway: somehostip
NetworkManager[62862]: <info>  [1590658768.5374] vpn-connection[,"vpn",14:(vpn0)]: Data: Tunnel Device: "vpn0"
NetworkManager[62862]: <info>  [1590658768.5374] vpn-connection[,"vpn",14:(vpn0)]: Data: IPv4 configuration:
NetworkManager[62862]: <info>  [1590658768.5375] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Address: 10.0.0.2
NetworkManager[62862]: <info>  [1590658768.5375] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Prefix: 19
NetworkManager[62862]: <info>  [1590658768.5375] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Point-to-Point Address: 10.0.0.55
NetworkManager[62862]: <info>  [1590658768.5375] vpn-connection[,"vpn",14:(vpn0)]: Data:   Static Route: 0.0.0.0/0   Next Hop: 0.0.0.0
NetworkManager[62862]: <info>  [1590658768.5376] vpn-connection[,"vpn",14:(vpn0)]: Data:   Static Route: 10.0.0.0/19   Next Hop: 0.0.0.0
NetworkManager[62862]: <info>  [1590658768.5376] vpn-connection[,"vpn",14:(vpn0)]: Data:   DNS Domain: 'xxx.com'  
NetworkManager[62862]: <info>  [1590658768.5376] vpn-connection[,"vpn",14:(vpn0)]: Data: IPv6 configuration:
NetworkManager[62862]: <info>  [1590658768.5377] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Address: ipv6addresswashere
NetworkManager[62862]: <info>  [1590658768.5377] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Prefix: 64
NetworkManager[62862]: <info>  [1590658768.5378] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal Point-to-Point Address: ipv6addresswashere
NetworkManager[62862]: <info>  [1590658768.5378] vpn-connection[,"vpn",14:(vpn0)]: Data:   Static Route: ::/0   Next Hop: ::
NetworkManager[62862]: <info>  [1590658768.5378] vpn-connection[,"vpn",14:(vpn0)]: Data:   Static Route: ipv6addresswashere   Next Hop: ::
NetworkManager[62862]: <info>  [1590658768.5378] vpn-connection[,"vpn",14:(vpn0)]: Data:   DNS Domain: 'xxx.com'  
NetworkManager[62862]: <info>  [1590658768.5380] vpn-connection[,"vpn",14:(vpn0)]: VPN plugin: state changed: started (4)
NetworkManager[62862]: <info>  [1590658768.5534] vpn-connection[,"vpn",14:(vpn0)]: VPN connection: (IP Config Get) complete
NetworkManager[62862]: <info>  [1590658768.5548] device (vpn0): state change: unmanaged -> unavailable (reason 'connection-assumed', sys-iface-state: 'external')
NetworkManager[62862]: <info>  [1590658768.5600] device (vpn0): state change: unavailable -> disconnected (reason 'connection-assumed', sys-iface-state: 'external')
NetworkManager[62862]: <info>  [1590658768.5615] device (vpn0): Activation: starting connection 'vpn0' (xxx)
NetworkManager[62862]: <info>  [1590658768.5616] manager: NetworkManager state is now CONNECTED_SITE
NetworkManager[62862]: <info>  [1590658768.5629] manager: NetworkManager state is now CONNECTED_LOCAL 
NetworkManager[62862]: <info>  [1590658768.5632] manager: NetworkManager state is now CONNECTED_SITE
NetworkManager[62862]: <info>  [1590658768.5633] policy: set 'vpn' (vpn0) as default for IPv4 routing and DNS

我查看了升级前的旧系统日志，其中有如下几行：

NetworkManager[1245]: <info>  [1590386910.5867] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal DNS: 10.0.0.1
NetworkManager[1245]: <info>  [1590386910.5867] vpn-connection[,"vpn",14:(vpn0)]: Data:   Internal DNS: 10.0.0.2

所以这些现在都不见了。任何人都知道如何解决这个问题？

我确实尝试使用 dns=auto 来使用 systemd-resolve ，但这有同样的问题。systemd-resolve --status 报告没有用于 vpn 连接的 dns 服务器，以及 /run/systemd/resolve/resolv.conf。

注意：我对所有 IP 地址和主机名等进行了匿名处理。

Answer 1

我找到了解决方案。基本上，如果 dns 服务器发送 ipv6 dns 服务器来查找 ipv4 地址，事情就会出错。Openconnect 会将 ipv6 地址放在 INTERNAL_IP4_DNS 中，而“network-manager-openconnect”并不期望如此，将整个变量（以及基本上所有 dns 服务器）视为垃圾并继续。我从 master 编译了我自己的 network-manager-openconnect ，它有一个修复程序，并且工作正常。

我不知道为什么我升级后会出现这个问题。也许在 openconnect 中发生了一些变化？或者也许在我升级公司网络管理员的那一天添加了一个 ipv6 dns 服务器？（我觉得不太可能……）

如果您使用的是 network-manager-openconnect 1.2.6 或 1.2.7-dev（甚至可能是更低版本，不包含修复程序），您可以像这样从 master 编译您自己的版本：

sudo apt-get build-dep network-manager-openconnect
mkdir ~/network-manager-openconnect_build
cd ~/network-manager-openconnect_build
git clone https://gitlab.gnome.org/GNOME/NetworkManager-openconnect.git
cd NetworkManager-openconnect
./autogen.sh
make
sudo mv /usr/lib/NetworkManager/nm-openconnect-service-openconnect-helper /usr/lib/NetworkManager/nm-openconnect-service-openconnect-helper_bak
sudo cp src/nm-openconnect-service-openconnect-helper /usr/lib/NetworkManager/nm-openconnect-service-openconnect-helper

注意：我只复制了 helper bin。从理论上讲，这可能会导致不兼容问题。我没有问题。但是如果你有，你可能会尝试从 src 复制主 bin 以及。

如果需要，您可以使用以下命令为 vpn 模块添加额外的日志记录，以便在 openconnect 收到任何 dns 数据时在系统日志中查看：

sudo nmcli general logging level KEEP domains VPN_PLUGIN:TRACE

如果您看到 INTERNAL_IP4_DNS 设置为 ipv4 和 ipv6 地址，并且您使用上述 openconnect 网络管理器版本，则您会受到此错误的影响。