opnsense / plugins

OPNsense plugin collection
https://opnsense.org/
BSD 2-Clause "Simplified" License
810 stars 593 forks source link

openconnect: Start doesn't work after timeout #4050

Open alexyao2015 opened 1 week ago

alexyao2015 commented 1 week ago

Important notices Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug My openconnect server will automatically disconnect after a period of time without opnsense disconnecting. When this happens, starting the plugin again will not cause the interface to come back.

To Reproduce

  1. Start openconnect
  2. From the server side, disconnect the client.
  3. Start openconnect client again and observe an ip address does not appear in interfaces.
  4. Stop and start openconnect again and observe an ip address appears.

Diagnosis I've determined that since the server side disconnects the client, the call to openconnect_stop is not made. Critically, the step to rename the ocvpn0 interface to tun3000 is not done. When starting the client again, it is unable to find the tun30000 interface because the stop procedure was not run.

https://github.com/opnsense/plugins/blob/58d06c7cc42dbb701a799507e8b6b875c70c42de/security/openconnect/src/etc/rc.d/opnsense-openconnect#L38

Potential solutions:

  1. In the startup procedure, attempt to detect if the stop routine was not called and rename an existing ocvpn0 interface back to tun30000 before proceeding.
  2. Remove the renaming of the ocvpn0 interface to tun30000. I am unaware of the implications of doing so and what the purpose of renaming the interface is in the first place. However, if this could be done, this would be the simplest solution.