Openvpn via stunnel

User1314 · 10-01-2016, 01:12 PM

Hi there!
My very first post on this forum.
I'm on Ubuntu 16.04, trying to connect to vpn server via ssl.
Connecting with stunnel works perfectly well. However, after trying connect to vpn I'm getting error: Assertion failed at misc.c:785 (es).
Here's full log below. I'd be really thankful if someone can point me to the right direction. Thanks!

Quote:

Sat Oct 1 16:01:22 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb 2 2016
Sat Oct 1 16:01:22 2016 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Sat Oct 1 16:01:22 2016 Control Channel Authentication: tls-auth using INLINE static key file
Sat Oct 1 16:01:22 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Oct 1 16:01:22 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Oct 1 16:01:22 2016 Socket Buffers: R=[87380->87380] S=[16384->16384]
Sat Oct 1 16:01:22 2016 Attempting to establish TCP connection with [AF_INET]127.0.0.1:1413 [nonblock]
Sat Oct 1 16:01:22 2016 TCP connection established with [AF_INET]127.0.0.1:1413
Sat Oct 1 16:01:22 2016 TCPv4_CLIENT link local: [undef]
Sat Oct 1 16:01:22 2016 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:1413
Sat Oct 1 16:01:23 2016 TLS: Initial packet from [AF_INET]127.0.0.1:1413, sid=cfadcc02 b995d086
Sat Oct 1 16:01:23 2016 VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, emailAddress=info@airvpn.org
Sat Oct 1 16:01:23 2016 Validating certificate key usage
Sat Oct 1 16:01:23 2016 ++ Certificate has key usage 00a0, expects 00a0
Sat Oct 1 16:01:23 2016 VERIFY KU OK
Sat Oct 1 16:01:23 2016 Validating certificate extended key usage
Sat Oct 1 16:01:23 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Oct 1 16:01:23 2016 VERIFY EKU OK
Sat Oct 1 16:01:23 2016 VERIFY OK: depth=0, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=server, emailAddress=info@airvpn.org
Sat Oct 1 16:01:25 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Oct 1 16:01:25 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Oct 1 16:01:25 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Oct 1 16:01:25 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Oct 1 16:01:25 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Sat Oct 1 16:01:25 2016 [server] Peer Connection Initiated with [AF_INET]127.0.0.1:1413
Sat Oct 1 16:01:28 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Oct 1 16:01:28 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.50.0.1,comp-lzo no,route-gateway 10.50.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.50.0.40 255.255.0.0'
Sat Oct 1 16:01:28 2016 OPTIONS IMPORT: timers and/or timeouts modified
Sat Oct 1 16:01:28 2016 OPTIONS IMPORT: LZO parms modified
Sat Oct 1 16:01:28 2016 OPTIONS IMPORT: --ifconfig/up options modified
Sat Oct 1 16:01:28 2016 OPTIONS IMPORT: route options modified
Sat Oct 1 16:01:28 2016 OPTIONS IMPORT: route-related options modified
Sat Oct 1 16:01:28 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Oct 1 16:01:28 2016 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=wlx00c0ca84a75e HWADDR=00:c0:ca:84:a7:5e
Sat Oct 1 16:01:28 2016 TUN/TAP device tun1 opened
Sat Oct 1 16:01:28 2016 TUN/TAP TX queue length set to 100
Sat Oct 1 16:01:28 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Oct 1 16:01:28 2016 /sbin/ip link set dev tun1 up mtu 1500
Sat Oct 1 16:01:28 2016 /sbin/ip addr add dev tun1 10.50.0.40/16 broadcast 10.50.255.255
Sat Oct 1 16:01:33 2016 /sbin/ip route add 127.0.0.1/32 via 192.168.0.1
RTNETLINK answers: File exists
Sat Oct 1 16:01:33 2016 ERROR: Linux route add command failed: external program exited with error status: 2
Sat Oct 1 16:01:33 2016 /sbin/ip route add 0.0.0.0/1 via 10.50.0.1
RTNETLINK answers: File exists
Sat Oct 1 16:01:33 2016 ERROR: Linux route add command failed: external program exited with error status: 2
Sat Oct 1 16:01:33 2016 /sbin/ip route add 128.0.0.0/1 via 10.50.0.1
RTNETLINK answers: File exists
Sat Oct 1 16:01:33 2016 ERROR: Linux route add command failed: external program exited with error status: 2
Sat Oct 1 16:01:33 2016 /sbin/ip route add 185.128.40.227/32 via 192.168.0.1
RTNETLINK answers: File exists
Sat Oct 1 16:01:33 2016 ERROR: Linux route add command failed: external program exited with error status: 2
Sat Oct 1 16:01:33 2016 Initialization Sequence Completed
Sat Oct 1 16:01:36 2016 Connection reset, restarting [0]
Sat Oct 1 16:01:36 2016 SIGUSR1[soft,connection-reset] received, process restarting
Sat Oct 1 16:01:36 2016 Restart pause, 5 second(s)
Sat Oct 1 16:01:41 2016 Socket Buffers: R=[87380->87380] S=[16384->16384]
Sat Oct 1 16:01:41 2016 Attempting to establish TCP connection with [AF_INET]127.0.0.1:1413 [nonblock]
Sat Oct 1 16:01:41 2016 TCP connection established with [AF_INET]127.0.0.1:1413
Sat Oct 1 16:01:41 2016 TCPv4_CLIENT link local: [undef]
Sat Oct 1 16:01:41 2016 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:1413
Sat Oct 1 16:01:41 2016 TLS: Initial packet from [AF_INET]127.0.0.1:1413, sid=25d7bd18 8c66240c
Sat Oct 1 16:01:41 2016 VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, emailAddress=info@airvpn.org
Sat Oct 1 16:01:41 2016 Validating certificate key usage
Sat Oct 1 16:01:41 2016 ++ Certificate has key usage 00a0, expects 00a0
Sat Oct 1 16:01:41 2016 VERIFY KU OK
Sat Oct 1 16:01:41 2016 Validating certificate extended key usage
Sat Oct 1 16:01:41 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Oct 1 16:01:41 2016 VERIFY EKU OK
Sat Oct 1 16:01:41 2016 VERIFY OK: depth=0, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=server, emailAddress=info@airvpn.org
Sat Oct 1 16:01:41 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Oct 1 16:01:41 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Oct 1 16:01:41 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Oct 1 16:01:41 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Oct 1 16:01:41 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Sat Oct 1 16:01:41 2016 [server] Peer Connection Initiated with [AF_INET]127.0.0.1:1413
Sat Oct 1 16:01:43 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Oct 1 16:01:44 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.50.0.1,comp-lzo no,route-gateway 10.50.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.50.0.40 255.255.0.0'
Sat Oct 1 16:01:44 2016 OPTIONS IMPORT: timers and/or timeouts modified
Sat Oct 1 16:01:44 2016 OPTIONS IMPORT: LZO parms modified
Sat Oct 1 16:01:44 2016 OPTIONS IMPORT: --ifconfig/up options modified
Sat Oct 1 16:01:44 2016 OPTIONS IMPORT: route options modified
Sat Oct 1 16:01:44 2016 OPTIONS IMPORT: route-related options modified
Sat Oct 1 16:01:44 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Oct 1 16:01:44 2016 Preserving previous TUN/TAP instance: tun1
Sat Oct 1 16:01:44 2016 Initialization Sequence Completed
Sat Oct 1 16:01:49 2016 Connection reset, restarting [0]
Sat Oct 1 16:01:49 2016 SIGUSR1[soft,connection-reset] received, process restarting
Sat Oct 1 16:01:49 2016 Restart pause, 5 second(s)
^CSat Oct 1 16:01:52 2016 Assertion failed at misc.c:785 (es)
Sat Oct 1 16:01:52 2016 Exiting due to fatal error

end · 10-15-2016, 02:15 AM

i see none answer your question long time. i dont have answer too

but ask on openvpn.net forum someone definitly answer you or put you on right direction. i google you problem, someone on openvpn forum reported as bug in some version.

i can ony suggest you remove everything and install latest version.

User1314 · 10-16-2016, 12:30 AM

Quote:

Originally Posted by end

i see none answer your question long time. i dont have answer too

but ask on openvpn.net forum someone definitly answer you or put you on right direction. i google you problem, someone on openvpn forum reported as bug in some version.

i can ony suggest you remove everything and install latest version.

Hey, end.

Thanks for your input. The reason I created this topic here, cause openvpn forum looked half dead.I've found few topics which looked related, however without solution.
I tried your suggestion. Tried on ubuntu, xubuntu, debian. The weirdest thing is works for very first time. Meaning, after my fresh install in works perfectly. However, after first connection been made - I'm getting error above.

Here's some more logs from stunnel:

Quote:

2016.10.14 00:22:25 LOG5[1479]: stunnel 5.06 on x86_64-pc-linux-gnu platform
2016.10.14 00:22:25 LOG5[1479]: Compiled with OpenSSL 1.0.1k 8 Jan 2015
2016.10.14 00:22:25 LOG5[1479]: Running with OpenSSL 1.0.1t 3 May 2016
2016.10.14 00:22:25 LOG5[1479]: Update OpenSSL shared libraries or rebuild stunnel
2016.10.14 00:22:25 LOG5[1479]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP
2016.10.14 00:22:25 LOG5[1479]: Reading configuration from file /etc/stunnel/stunnel.conf
2016.10.14 00:22:25 LOG5[1479]: FIPS mode disabled
2016.10.14 00:22:25 LOG6[1479]: Initializing service [openvpn]
2016.10.14 00:22:25 LOG5[1479]: Configuration successful
2016.10.14 00:22:25 LOG5[1480]: Service [openvpn] accepted connection from 127.0.0.1:42640
2016.10.14 00:22:25 LOG6[1480]: s_connect: connecting 89.238.166.236:443
2016.10.14 00:22:26 LOG5[1480]: s_connect: connected 89.238.166.236:443
2016.10.14 00:22:26 LOG5[1480]: Service [openvpn] connected remote server from 192.168.0.9:57092
2016.10.14 00:22:26 LOG6[1480]: SNI: sending servername: 89.238.166.236
2016.10.14 00:22:27 LOG6[1480]: CERT: Locally installed certificate matched
2016.10.14 00:22:27 LOG5[1480]: Certificate accepted at depth=0: C=IT, ST=Italy, L=Perugia, O=AirVPN, OU=stunnel, CN=stunnel.airvpn.org, emailAddress=info@airvpn.org
2016.10.14 00:22:27 LOG6[1480]: SSL connected: new session negotiated
2016.10.14 00:22:27 LOG6[1480]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption)
2016.10.14 00:22:27 LOG6[1480]: Compression: null, expansion: null
ifconfig
2016.10.14 00:23:37 LOG5[1563]: Service [openvpn] accepted connection from 127.0.0.1:42642
2016.10.14 00:23:37 LOG6[1563]: s_connect: connecting 89.238.166.236:443
2016.10.14 00:23:37 LOG5[1563]: s_connect: connected 89.238.166.236:443
2016.10.14 00:23:37 LOG5[1563]: Service [openvpn] connected remote server from 192.168.0.9:57094
2016.10.14 00:23:37 LOG6[1563]: SNI: sending servername: 89.238.166.236
2016.10.14 00:23:37 LOG6[1563]: SSL connected: previous session reused
2016.10.14 00:23:38 LOG6[1480]: SSL closed (SSL_read)
2016.10.14 00:23:38 LOG6[1480]: Read socket closed (readsocket)
2016.10.14 00:23:38 LOG6[1480]: Read socket closed (hangup)
2016.10.14 00:23:38 LOG6[1480]: Write socket closed (hangup)
2016.10.14 00:23:38 LOG6[1480]: SSL_shutdown successfully sent close_notify alert
2016.10.14 00:23:38 LOG5[1480]: Connection closed: 5868 byte(s) sent to SSL, 6639 byte(s) sent to socket
2016.10.14 00:23:43 LOG5[1608]: Service [openvpn] accepted connection from 127.0.0.1:42644
2016.10.14 00:23:43 LOG6[1608]: s_connect: connecting 89.238.166.236:443
2016.10.14 00:23:43 LOG5[1608]: s_connect: connected 89.238.166.236:443
2016.10.14 00:23:43 LOG5[1608]: Service [openvpn] connected remote server from 192.168.0.9:57096
2016.10.14 00:23:43 LOG6[1608]: SNI: sending servername: 89.238.166.236
2016.10.14 00:23:44 LOG6[1608]: SSL connected: previous session reused
2016.10.14 00:23:45 LOG6[1563]: SSL closed (SSL_read)
2016.10.14 00:23:45 LOG6[1563]: Read socket closed (readsocket)
2016.10.14 00:23:45 LOG6[1563]: Read socket closed (hangup)
2016.10.14 00:23:45 LOG6[1563]: Write socket closed (hangup)
2016.10.14 00:23:45 LOG6[1563]: SSL_shutdown successfully sent close_notify alert
2016.10.14 00:23:45 LOG5[1563]: Connection closed: 5442 byte(s) sent to SSL, 6213 byte(s) sent to socket
2016.10.14 00:23:50 LOG5[1626]: Service [openvpn] accepted connection from 127.0.0.1:42646
2016.10.14 00:23:50 LOG6[1626]: s_connect: connecting 89.238.166.236:443
2016.10.14 00:23:50 LOG5[1626]: s_connect: connected 89.238.166.236:443
2016.10.14 00:23:50 LOG5[1626]: Service [openvpn] connected remote server from 192.168.0.9:57098
2016.10.14 00:23:50 LOG6[1626]: SNI: sending servername: 89.238.166.236
2016.10.14 00:23:50 LOG6[1626]: SSL connected: previous session reused
2016.10.14 00:23:51 LOG6[1608]: SSL closed (SSL_read)
2016.10.14 00:23:51 LOG6[1608]: Read socket closed (readsocket)
2016.10.14 00:23:51 LOG6[1608]: Read socket closed (hangup)
2016.10.14 00:23:51 LOG6[1608]: Write socket closed (hangup)
2016.10.14 00:23:51 LOG6[1608]: SSL_shutdown successfully sent close_notify alert
2016.10.14 00:23:51 LOG5[1608]: Connection closed: 5545 byte(s) sent to SSL, 6396 byte(s) sent to socket
2016.10.14 00:23:56 LOG5[1628]: Service [openvpn] accepted connection from 127.0.0.1:42648
2016.10.14 00:23:56 LOG6[1628]: s_connect: connecting 89.238.166.236:443
2016.10.14 00:23:56 LOG5[1628]: s_connect: connected 89.238.166.236:443
2016.10.14 00:23:56 LOG5[1628]: Service [openvpn] connected remote server from 192.168.0.9:57100
2016.10.14 00:23:56 LOG6[1628]: SNI: sending servername: 89.238.166.236
2016.10.14 00:23:56 LOG6[1628]: SSL connected: previous session reused
2016.10.14 00:23:57 LOG6[1626]: SSL closed (SSL_read)
2016.10.14 00:23:57 LOG6[1626]: Read socket closed (readsocket)
2016.10.14 00:23:57 LOG6[1626]: Read socket closed (hangup)
2016.10.14 00:23:57 LOG6[1626]: Write socket closed (hangup)
2016.10.14 00:23:57 LOG6[1626]: SSL_shutdown successfully sent close_notify alert
2016.10.14 00:23:57 LOG5[1626]: Connection closed: 5442 byte(s) sent to SSL, 6213 byte(s) sent to socket
2016.10.14 00:24:02 LOG5[1629]: Service [openvpn] accepted connection from 127.0.0.1:42650
2016.10.14 00:24:02 LOG6[1629]: s_connect: connecting 89.238.166.236:443
2016.10.14 00:24:02 LOG5[1629]: s_connect: connected 89.238.166.236:443
2016.10.14 00:24:02 LOG5[1629]: Service [openvpn] connected remote server from 192.168.0.9:57102
2016.10.14 00:24:02 LOG6[1629]: SNI: sending servername: 89.238.166.236
2016.10.14 00:24:02 LOG6[1629]: SSL connected: previous session reused
2016.10.14 00:24:03 LOG6[1628]: SSL closed (SSL_read)
2016.10.14 00:24:03 LOG6[1628]: Read socket closed (readsocket)
2016.10.14 00:24:03 LOG6[1628]: Read socket closed (hangup)
2016.10.14 00:24:03 LOG6[1628]: Write socket closed (hangup)
2016.10.14 00:24:03 LOG6[1628]: SSL_shutdown successfully sent close_notify alert
2016.10.14 00:24:03 LOG5[1628]: Connection closed: 5442 byte(s) sent to SSL, 6213 byte(s) sent to socket
2016.10.14 00:24:08 LOG5[1630]: Service [openvpn] accepted connection from 127.0.0.1:42652
2016.10.14 00:24:08 LOG6[1630]: s_connect: connecting 89.238.166.236:443
2016.10.14 00:24:08 LOG5[1630]: s_connect: connected 89.238.166.236:443
2016.10.14 00:24:08 LOG5[1630]: Service [openvpn] connected remote server from 192.168.0.9:57104
2016.10.14 00:24:08 LOG6[1630]: SNI: sending servername: 89.238.166.236
2016.10.14 00:24:08 LOG6[1630]: SSL connected: previous session reused
2016.10.14 00:24:09 LOG6[1629]: SSL closed (SSL_read)
2016.10.14 00:24:09 LOG6[1629]: Read socket closed (readsocket)
2016.10.14 00:24:09 LOG6[1629]: Read socket closed (hangup)
2016.10.14 00:24:09 LOG6[1629]: Write socket closed (hangup)
2016.10.14 00:24:09 LOG6[1629]: SSL_shutdown successfully sent close_notify alert
2016.10.14 00:24:09 LOG5[1629]: Connection closed: 5442 byte(s) sent to SSL, 6213 byte(s) sent to socket
2016.10.14 00:24:14 LOG5[1631]: Service [openvpn] accepted connection from 127.0.0.1:42654
2016.10.14 00:24:14 LOG6[1631]: s_connect: connecting 89.238.166.236:443
2016.10.14 00:24:14 LOG5[1631]: s_connect: connected 89.238.166.236:443
2016.10.14 00:24:14 LOG5[1631]: Service [openvpn] connected remote server from 192.168.0.9:57106
2016.10.14 00:24:14 LOG6[1631]: SNI: sending servername: 89.238.166.236
2016.10.14 00:24:14 LOG6[1631]: SSL connected: previous session reused
2016.10.14 00:24:15 LOG6[1630]: SSL closed (SSL_read)
2016.10.14 00:24:15 LOG6[1630]: Read socket closed (readsocket)
2016.10.14 00:24:15 LOG6[1630]: Read socket closed (hangup)
2016.10.14 00:24:15 LOG6[1630]: Write socket closed (hangup)
2016.10.14 00:24:15 LOG6[1630]: SSL_shutdown successfully sent close_notify alert
2016.10.14 00:24:15 LOG5[1630]: Connection closed: 5442 byte(s) sent to SSL, 6213 byte(s) sent to socket
2016.10.14 00:24:20 LOG5[1632]: Service [openvpn] accepted connection from 127.0.0.1:42656
2016.10.14 00:24:20 LOG6[1632]: s_connect: connecting 89.238.166.236:443
2016.10.14 00:24:20 LOG5[1632]: s_connect: connected 89.238.166.236:443
2016.10.14 00:24:20 LOG5[1632]: Service [openvpn] connected remote server from 192.168.0.9:57108
2016.10.14 00:24:20 LOG6[1632]: SNI: sending servername: 89.238.166.236
2016.10.14 00:24:20 LOG6[1632]: SSL connected: previous session reused
2016.10.14 00:24:21 LOG6[1631]: SSL closed (SSL_read)
2016.10.14 00:24:21 LOG6[1631]: Read socket closed (readsocket)
2016.10.14 00:24:21 LOG6[1631]: Read socket closed (hangup)
2016.10.14 00:24:21 LOG6[1631]: Write socket closed (hangup)
2016.10.14 00:24:21 LOG6[1631]: SSL_shutdown successfully sent close_notify alert
2016.10.14 00:24:21 LOG5[1631]: Connection closed: 5442 byte(s) sent to SSL, 6213 byte(s) sent to socket

And as result of all this mess I'm getting another tun1 created. Here's routing tables

Quote:

default 10.50.0.1 128.0.0.0 UG 0 0 0 tun0
default 192.168.0.1 0.0.0.0 UG 1024 0 0 wlan1
10.50.0.0 * 255.255.0.0 U 0 0 0 tun0
10.50.0.0 * 255.255.0.0 U 0 0 0 tun1
server3.etsende 192.168.0.1 255.255.255.255 UGH 0 0 0 wlan1
localhost 192.168.0.1 255.255.255.255 UGH 0 0 0 wlan1
128.0.0.0 10.50.0.1 128.0.0.0 UG 0 0 0 tun0
link-local * 255.255.0.0 U 1000 0 0 wlan1
192.168.0.0 * 255.255.255.0 U 0 0 0 wlan1

You might be right - I should give a try on openvpn forum. Thanks

end · 10-16-2016, 11:06 AM

pos in openvpn forum under configuration part of forum.

do you maybe run client and server from same host