VPN is broken on Acer A1-840 (Android 4.4.4 (sdk=19) on x86, kernel 3.10.20+)

[TPS]

Bug filed on ticket #WTK-439-66735 & log sent on #JSH-420-34097 (I think).

[ameshkov]

Device info { "androidVersion" : "4.4.4 (sdk=19)", "appLanguage" : "en", "applicationId" : "1318bbf76c3df2c3", "whitelist" : [ ], "versionName" : "2.0.62", "currentWifiProxyConfiguration" : "host=localhost port=8080 exclusions= manual", "deviceName" : "Acer A1-840", "userfilter" : [ ], "enabledFilterIds" : [ 2, 3, 4, 5, 1, 6, 7, 8, 9, 11 ], "environment" : "prod", "filteringQuality" : "FULL", "statisticsInfo" : "Blocked threats:0; Blocked banners:0; Traffic saved:0;", "firewallConfiguration" : { "defaultPermissions" : [ "MOBILE", "WIFI" ], "permissionsMap" : { "com.dolphin.browser.express.web" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.yandex.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.asus.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.uc.browser.en" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "jp.ddo.pigsty.Habit_Browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.boatgo.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.appdream.cloud" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.baidu.browserhd.inter" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "org.mozilla.firefox" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "ru.yandex.shell" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.cloudmosa.puffinFree" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.jiubang.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.fevdev.nakedbrowser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "internetexplorer.browser.webexplorer" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.nubelacorp.javelin" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.android.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.metalasfook.nochromo" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.baidu.browser.inter" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.opera.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.dolphin.web.browser.android" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.fevdev.nakedbrowserpro" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.UCMobile.intl" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "cn.mozilla.firefox" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.sec.android.app.sbrowser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.droid.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.boatbrowser.license.key" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "me.android.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.opera.browser.beta" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.swe.atego.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.rocket.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.uc.browser.hd" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.ninesky.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "jp.ddo.pigsty.HabitBrowser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "acr.browser.lightning" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.tencent.ibibo.mtt" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "mobi.browser.flfoxpro" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.opera.mini.android.yandex" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.chrome.dev" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.opera.browser.yandex" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "explore.web.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.ilegendsoft.mercury" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.cloudmosa.puffin" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "org.mozilla.firefox_beta" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.chrome.beta" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "ru.mail.amigo" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "org.tint" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.opera.mini.android" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.explore.web.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "acr.browser.barebones" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.mx.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.dolphin.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "mobi.browser.flashfox" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "nextapp.atlas" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.boatbrowser.tablet" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.boatbrowser.free" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "mobi.mgeek.TunnyBrowser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.UCMobile.intl.x86" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.opera.browser.classic" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "org.easyweb.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.mx.browser.tablet" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.android.chrome" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "net.fast.web.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.htc.sense.browser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "nu.tommie.inbrowser" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.vionika.firephoenix" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.yandex.browser.beta" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.ksmobile.cb" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.finalwire.aida64" : [ "MOBILE" ], "com.google.android.apps.authenticator2" : [ "MOBILE" ], "com.android.bluetooth" : [ "MOBILE" ], "com.cleanmaster.mguard" : [ "MOBILE", "WIFI" ], "com.dolphin.browser.zero" : [ "MOBILE", "WIFI" ], "com.wildtangent.android" : [ "MOBILE" ], "com.google.android.partnersetup" : [ "MOBILE" ], "com.oasisfeng.greenify" : [ "MOBILE" ], "com.android.phone" : [ "MOBILE" ], "com.mobisystems.editor.office_acer" : [ "MOBILE" ], "com.android.pacprocessor" : [ "MOBILE" ], "com.backflipstudios.android.wizardduel" : [ "MOBILE" ], "jackpal.androidterm" : [ "MOBILE" ], "tunein.player" : [ "MOBILE" ], "com.android.exchange" : [ "MOBILE" ], "com.android.email" : [ "MOBILE" ], "com.google.android.apps.magazines" : [ "MOBILE", "WIFI" ], "com.amazon.cloud9" : [ "MOBILE", "WIFI", "AD_FILTERING" ], "com.adguard.android" : [ "MOBILE", "WIFI" ], "com.pcvirt.ImageEditor" : [ "MOBILE" ], "com.metago.astro" : [ "MOBILE" ], "com.accuweather.android" : [ "MOBILE" ], "com.acer.ccd" : [ "MOBILE" ], "com.acerstore.android" : [ "MOBILE" ], "com.acer.android.appmanager2" : [ "MOBILE" ], "com.audible.application" : [ "MOBILE" ], "com.google.zxing.client.android" : [ "MOBILE" ], "com.google.android.inputmethod.pinyin" : [ "MOBILE" ], "com.google.android.inputmethod.latin" : [ "MOBILE" ], "com.google.android.apps.books" : [ "MOBILE" ], "com.google.android.videos" : [ "MOBILE" ], "com.google.android.googlequicksearchbox" : [ "MOBILE" ], "com.google.android.tts" : [ "MOBILE" ], "com.google.android.apps.plus" : [ "MOBILE" ], "com.acer.android.widget.digitalclock3" : [ "MOBILE" ], "com.acer.android.widget.weather3" : [ "MOBILE" ], "com.google.android.apps.maps" : [ "MOBILE" ], "com.wsandroid.suite" : [ "MOBILE" ], "com.android.musicfx" : [ "MOBILE" ], "com.google.android.street" : [ "MOBILE" ], "com.zinio.mobile.android.reader" : [ "MOBILE" ], "com.docSaveNGo" : [ "MOBILE" ], "com.acer.remotefiles" : [ "MOBILE" ], "com.acer.c5music" : [ "MOBILE" ], "com.acer.c5photo" : [ "MOBILE" ], "com.acer.c5video" : [ "MOBILE" ], "com.zuuka.istorytime" : [ "MOBILE" ], "com.ghostery.android.ghostery" : [ "MOBILE", "WIFI" ], "com.evernote" : [ "MOBILE" ] }, "filterAppsTraffic" : false }, "installerPackage" : null, "kernelVersion" : "3.10.20+", "sourceApk" : "/data/app/com.adguard.android-2.apk", "referrer" : null, "proxyPort" : 8080, "proxySetupManualMode" : true, "proxyMode" : true, "sendAnonymousStatistics" : false, "showUsefulAds" : false, "premium" : false, "filtersAutoUpdateEnabled" : true, "trial" : false, "deviceSpeedRank" : 926, "browsingSecurityEnabled" : false, "autoStartEnabled" : true }

[ameshkov]

Here is what's going on:

18:51:58.225 [Thread-34] DEBUG c.a.a.f.filter.NetConnectionFinder - NetConnectionInfo not found on 0 step!
18:51:58.243 [Thread-34] DEBUG c.a.a.f.filter.NetConnectionFinder - NetConnectionInfo not found on 1 step!
18:51:58.260 [Thread-34] DEBUG c.a.a.f.filter.NetConnectionFinder - NetConnectionInfo not found on 2 step!
18:51:58.272 [Thread-34] DEBUG c.a.a.filtering.commons.LogUtils - TCP id=2388 Creating new connection null with packet TCP XXX:47302 > XXX:443 [SYN] seq=-1888882596 ack=0 win=13020 mss=4340 scale=6 len=0
18:51:58.272 [Thread-34] DEBUG c.a.a.filtering.commons.LogUtils - TCP id=2388 Connection has been created.
18:51:58.275 [pool-2-thread-315] DEBUG c.a.a.filtering.commons.LogUtils - TCP id=2388 Connecting to /XXX:443

[TPS]

So is this a legit bug, or is this something else? Also, is title correct?

[ameshkov]

I suspect that the cause of this issue is our VPN configuration (it is rather complicated because we are trying to exclude LAN from VPN). Maybe if we use simple config this bug will be fixed.

The problem with the log file is that it is trimmed to 500kb and I don't see VPN settings there. Could you please collect the logs again (but now don't change logging level, INFO is enough)?

[TPS]

Will do in the next 24 hours or so.… Thanks!

[ameshkov]

Ok, no problem:)

[ameshkov]

Could you please try this test build?

http://static.adguard.com/android/release/adguard_issue23.apk

[TPS]

Just sent default-level log for VPN test from http://static.adguard.com/android/release/adguard_issue23.apk.

Had to resend log to get ticket #EJD-676-66257.… I hope it's correct!

Thank you!

[ameshkov]

It seems that changing VPN route didn't help in your case:(

Same errors in the log:

TCP id=5 Cannot connect to /XXX:80 for com.adguard.android: failed to connect to /XXX (port 80) after 5000ms

Let's test some other VPN app to check if it is simply possible to use VpnService on your device/ROM? Try this one please: https://play.google.com/store/apps/details?id=app.greyshirts.firewall

[TPS]

I've actually used this 1 in the past.… Works perfectly, but requires too much configuration for my taste. ☺

[ameshkov]

Nothing has changed since then? Does it still work without errors on your device?

[TPS]

I will spend some quality time revisiting https://play.google.com/store/apps/details?id=app.greyshirts.firewall to make sure, then. ☺

Confirmed works perfectly fine, even in conjunction with AdGuard. Only problem is excessive memory use & lack of IPv6 filtering.

[ameshkov]

Weird, test build that I've sent to you does pretty the same.

The main difference is IPv6 filtering presence. I'll create some more test builds, without IPv6 and with a bit different Vpn settings.

[TPS]

@ameshkov I'm ready & willing to try whenever you have 'em. ☺

According to what I (re)discovered in https://github.com/AdguardTeam/AdguardForAndroid/issues/35#issuecomment-137484089, the Orbot team is also finding x86 VPN-mode challenging.

Further update: I'm now trying the build from https://github.com/AdguardTeam/AdguardForAndroid/issues/2#issuecomment-137747776, so any test builds should perhaps be based from this? For the record, (not that I expected ;) this 1 didn't change anything re: VPN working for me, but, if the WiFi connection is "forgotten" (I wiped the authentication info accidentally fiddling the proxy settings) while AG is in VPN mode, this build crashes on every (re)start. Is this #36, or does this warrant a separate bug filed?

[Revertron]

"Is this #36, or does this warrant a separate bug filed?" - this was my fault, i've fixed it already. :)

[ameshkov]

@TPS, could you please try the new build?

The same link: http://static.adguard.com/android/release/adguard_issue23.apk

Thanks to #42 we now have "Low-level settings" section and we can do some experiments with VPN settings.

pref.vpn.ipv4.force.default -- forces default vpn route for ipv4 (without LAN exclusion) pref.vpn.ipv6.bypass -- uses a special IPv6 route which allows traffic to bypass VPN pref.vpn.ipv6.disable -- disables IPv6 filtering

Could you please try it with different settings (especially try disabling IPv6 filtering)?

[TPS]

@ameshkov I'm currently testing @Revertron's build from here. Does yours supersede or include his? Else, I still have around 24 hours till I'm done working with his build, & then I'll jump on yours.… Unfortunately, I can't run parallel builds! ☺

[ameshkov]

Mine includes it

[TPS]

The build just notified to update to beta 2.0.106.… I'm assuming it's ok to test with?

I think report# IPI-833-82573 will work for both #2 & #23, but feed me further instructions as how you want me to test. I saw no difference in # or frequency of restarts, nor did VPN function under any debug option even for the simplest of tests — simply requesting AG filter updates.

[Revertron]

Vpn building log: Cannot exclude LAN for this kernel: 3.10.20+ Default route 0.0.0.0/0 will be used for vpn session. IPv6 does not work in Android 4.4.X: https://code.google.com/p/android/issues/detail?id=63349

Many such strings: TCP id=2657 Cannot connect to /185.22.60.23:80 for com.adguard.android: failed to connect to /185.22.60.23 (port 80) after 5000ms Every 5-6ms.

All I see - there is no connectivity for some reason...

[TPS]

I think you mean IPv6 VPN isn't supported in Android v4.4.x, as https://ipv6.Google.com/ works just fine. I guess 1 would have to live with that, as that's a platform limitation, but what about standard IPv4 on my tablet?

[ameshkov]

Yas, IPv6 VPN, that's right. I still don't know the answer on the second question:(

@Revertron let's create a test build without /proc/net/tcp parsing. I think that's the only major difference left between NoRoot Firewall and our VPN.

[ameshkov]

UPD: Ok i am wrong, noroot firewall parses it too.

[ameshkov]

@TPS, could you please test it once more and send us the full log file with logging level "Record everything".

Search for the log in these directories:

/storage/emulated/Android/data/com.adguard.android/cache/log
/sdcard/Android/com.adguard.android/cache/log
/sdcard/data/Android/com.adguard.android/cache/log
/sdcard/Android/data/com.adguard.android/

Current log is enough to see that problem is not fixed, but not enough to understand what to do:)

[TPS]

@ameshkov Certainly! Just need some clarifications, please:

1. Last time I sent a "Record everything" log, the important bits fell off the top, so, over what duration?
2. Do I need to send the logs from each of the directories above & the "Record everything" log, or 1 or the other? How should I send those logs?

I will follow-up in 10 hours or so.… Off to the job! ☺

[ameshkov]

@TPS

1. The log in IPI-833-82573 is not with "record everything" level. Also the problem with logs sent from the app is that the file is trimmed to 512 kb and it's not enough.
2. There should be only one directory, it's just different depending on the device.

[TPS]

@ameshkov I understand & will locate the log/directory. How should I post/send the info? There's likely to be a lot of info that should be redacted if I post here!

[ameshkov]

You can sent it to my email: am@adguard.com

[TPS]

I'm planning on scheduling this for Sep 20, & sent on 21 as this log looks to be backed up for 1 day at a time, so I figure I'll send that backup. Ok?

@ameshkov I'm in the middle of ↑, but I just realized that @Revertron has put out a new build. Is that relevant enough for me to update mid-test?

Nevermind, kept official beta & are sending compressed log; should cover #2, #23, #50, & who knows what else.… Happy hunting! ☺

[ameshkov]

@TPS i've received the log file, thank you!

The problem now is that there's nothing about VPN in that log. Are you sure you've tested it on Sep 20?

[Revertron]

@TPS I've seen the normal VPN work in that log. But the lines about establishing VPN are cut out :(

[TPS]

@ameshkov @Revertron That's weird, because I specifically waited to establish VPN until that log.… Should be toward the beginning. But I did no editing whatsoever.

[ameshkov]

@Revertron where? I see only proxy work there, no packets crafting, nothing about vpn connections

[Revertron]

@ameshkov Ah, I saw the proxy logs and thought that traffic definitely goes through us...

[TPS]

Then that seems to shows something strange all around: When I establish VPN on my ARM phone, everything looks the same, step-wise, as when I try on this tablet: I switch to VPN-mode, I hit the big green button, Android pops-up the message asking do you really trust AdGuard to establish a VPN, I approve, & I get the lock in the statusbar. I just get no connection on the tablet, while I do on the phone.… Would screenshots or some other log help? I think I'm at the ultimate end for AG logs, right? Unless there's a higher level that can be toggled?

[Revertron]

@TPS I've made a tool to catch logcat logs through USB. You can download it from here: https://cdn.adguard.com/public/Adguard/tools/LogcatTool.zip Just unzip it to any folder and run logcat_adguard.cmd, it will save all log lines containing "adguard" in it. Don't forget to plug in your tablet to PC :) Just do it after establishing VPN on your tablet. May be there are some errors that aren't written to our log.

[ameshkov]

@TPS what you describe is normal, but in the log you've collected before I don't see any trace of the VPN.

I bet the log you've sent is for the time when you were using AG in proxy mode. Could you please try it one more time? Just don't try to reproduce other issues, collect logs right after trying VPN.

[TPS]

@ameshkov @Revertron I just came across https://groups.google.com/forum/#!topic/android-x86/tktiqciItMM which mentions that Android-x86 VPN is broken at system level, so no apps can ever be successful. So I shall close this due to lack of OS support. :disappointed:

[ameshkov]

@TPS but why does NoRoot Firewall works for you?

[TPS]

That is strange.… I've no idea! I'd forgotten about that. Maybe their Force is strong? :wink:

When I get a working PC setup, I'll try this logging method & send it in to see what turns up, & then perhaps reopen, good?

[ameshkov]

Let's reopen it right now otherwise I am sure this issue will be forgotten:)

[ameshkov]

@TPS I have just got an idea. The only major difference between Adguard's VPN and No Root Firewall VPN is MTU size.

Could you please try changing it?

1. Go to "Low level settings"
2. Change "pref.vpn.tun.mtu" to 1500
3. Exit Adguard and run it again (this step is important otherwise MTU change won't be properly applied).

[TPS]

@ameshkov I've just tried this & sent you (via e-mail) the associated logs. Briefly, it didn't work, but I'm hoping the new PCAP option + the everything log may give some clarity. :grimacing:

[ameshkov]

@TPS i've got the logs, thank you:)

[ameshkov]

The same issue here:(

00:15:00.122 [pool-2-thread-32] WARN  c.a.a.filtering.commons.LogUtils - TCP id=31 Cannot connect to /XXXXXX:80 for com.adguard.android

java.net.SocketTimeoutException: failed to connect to /XXXXXXX (port 80) after 5000ms
    at libcore.io.IoBridge.connectErrno(IoBridge.java:159) ~[na:0.0]
    at libcore.io.IoBridge.connect(IoBridge.java:112) ~[na:0.0]
    at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:192) ~[na:0.0]
    at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:459) ~[na:0.0]
    at java.net.Socket.connect(Socket.java:843) ~[na:0.0]
    at java.nio.SocketChannelImpl$SocketAdapter.connect(SocketChannelImpl.java:532) ~[na:0.0]
    at com.adguard.android.filtering.vpn.VpnTcpConnection.connect(Unknown Source) ~[na:0.0]
    at com.adguard.android.filtering.vpn.VpnTcpConnection.connect(Unknown Source) ~[na:0.0]
    at com.adguard.android.filtering.vpn.VpnTcpConnection.tcpInputClosed(Unknown Source) ~[na:0.0]
    at com.adguard.android.filtering.vpn.VpnTcpConnection.addBrowserInputPacket(Unknown Source) ~[na:0.0]
    at com.adguard.android.filtering.vpn.BaseVpnConnection$1.run(Unknown Source) ~[na:0.0]
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:422) ~[na:0.0]
    at java.util.concurrent.FutureTask.run(FutureTask.java:237) ~[na:0.0]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1112) ~[na:0.0]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:587) ~[na:0.0]
    at java.lang.Thread.run(Thread.java:841) ~[na:0.0]

[Revertron]

@TPS can you try VPN on this Acer with our recent build? http://bit.do/adguard-last-build

[TPS]

@Revertron In short, no (visible) difference on this .138 build nor current .140 build. Ticket# DFD-848-79510.

[ameshkov]

Good old issue with connection timeout in the log.

[TPS]

AB+ reportedly improved some things on x86 by specifically compiling for it. On the downside, it doubled the size of the APK. Thoughts? Something worth trying, at least in a test build?

[ameshkov]

I don't think it can change things as we use managed (java) code mostly, it is not compiled. (specifically that part of the program where we have an error in your case).