Bug 479937 - [openeconnect] Timeout after authentication connecting to GlobalProtect VPN
Summary: [openeconnect] Timeout after authentication connecting to GlobalProtect VPN
Status: REPORTED
Alias: None
Product: plasmashell
Classification: Plasma
Component: Networks widget (show other bugs)
Version: master
Platform: Arch Linux Linux
: NOR normal
Target Milestone: 1.0
Assignee: Plasma Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-17 10:54 UTC by Knut Andre Tidemann
Modified: 2024-12-23 18:26 UTC (History)
0 users

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Knut Andre Tidemann 2024-01-17 10:54:30 UTC
SUMMARY
When trying to connect to my work place's GlobalProtect VPN, the connection times out after the authentication and gateway selection phase. This used to work some time ago (roughly 1 year ago), but I do not use this often enough to pinpoint when in stopped working. It could also be something that changed one the server side.

What does work is to connect using 'nmcli --ask connection up VPN', so it's definitely something with plasma-nm.

STEPS TO REPRODUCE
1. Connect to GlobalProtect VPN
2. Enter username / password and log in
3. Select gateway and the authentication window closes. Timeout occurs in ~1 minute.

OBSERVED RESULT
Log output is somewhat lacking:

Jan 17 11:17:16 kyle NetworkManager[790]: <info>  [1705486636.7962] vpn[0x64677478fac0,040f8208-cd33-45b7-8f5a-8805f67317d1,"VPN"]: starting openconnect
Jan 17 11:17:16 kyle NetworkManager[790]: <info>  [1705486636.7964] audit: op="connection-activate" uuid="040f8208-cd33-45b7-8f5a-8805f67317d1" name="VPN" pid=1205 uid=1000 result="success"
Jan 17 11:17:16 kyle kernel: tun: Universal TUN/TAP device driver, 1.6
Jan 17 11:17:16 kyle kded5[1146]: org.kde.plasma.nm.kded: Unhandled VPN connection state change:  NetworkManager::VpnConnection::NeedAuth
Jan 17 11:17:16 kyle kded5[1146]: kf.networkmanagerqt: void NetworkManager::ConnectionPrivate::onPropertiesChanged(const QVariantMap&) Unhandled property "VersionId"
Jan 17 11:17:16 kyle plasmashell[1205]: kf.networkmanagerqt: void NetworkManager::ConnectionPrivate::onPropertiesChanged(const QVariantMap&) Unhandled property "VersionId"
Jan 17 11:17:16 kyle kded5[1146]: kf.networkmanagerqt: void NetworkManager::ConnectionPrivate::onPropertiesChanged(const QVariantMap&) Unhandled property "VersionId"
Jan 17 11:17:16 kyle plasmashell[1205]: kf.networkmanagerqt: void NetworkManager::ConnectionPrivate::onPropertiesChanged(const QVariantMap&) Unhandled property "VersionId"
Jan 17 11:17:17 kyle plasmashell[1205]: file:///usr/lib/qt/qml/org/kde/plasma/extras/PlaceholderMessage.qml:238:5: QML Heading: Binding loop detected for property "verticalAlignment"
Jan 17 11:17:18 kyle kded5[1146]: QFormLayout::takeAt: Invalid index 0
Jan 17 11:17:39 kyle kded5[1146]: QFormLayout::takeAt: Invalid index 0
Jan 17 11:17:39 kyle kded5[1146]: kf.networkmanagerqt: void NetworkManager::ConnectionPrivate::onPropertiesChanged(const QVariantMap&) Unhandled property "VersionId"
Jan 17 11:17:39 kyle kded5[1146]: org.kde.plasma.nm.kded: Unhandled VPN connection state change:  NetworkManager::VpnConnection::Connecting
Jan 17 11:17:39 kyle NetworkManager[790]: <info>  [1705486659.2530] manager: (vpn0): new Tun device (/org/freedesktop/NetworkManager/Devices/3)
Jan 17 11:17:39 kyle plasmashell[1205]: kf.networkmanagerqt: void NetworkManager::ConnectionPrivate::onPropertiesChanged(const QVariantMap&) Unhandled property "VersionId"
Jan 17 11:17:39 kyle kded5[1146]: kf.networkmanagerqt: void NetworkManager::ConnectionPrivate::onPropertiesChanged(const QVariantMap&) Unhandled property "VersionId"
Jan 17 11:17:39 kyle NetworkManager[790]: <info>  [1705486659.2563] audit: op="connection-update" uuid="040f8208-cd33-45b7-8f5a-8805f67317d1" name="VPN" args="connection.timestamp,vpn.secrets" pid=1146 uid=1000 result="success"
Jan 17 11:17:39 kyle NetworkManager[3631]: POST https://1.2.3.4/ssl-vpn/getconfig.esp
Jan 17 11:17:39 kyle plasmashell[1205]: kf.networkmanagerqt: void NetworkManager::ConnectionPrivate::onPropertiesChanged(const QVariantMap&) Unhandled property "VersionId"
Jan 17 11:17:39 kyle NetworkManager[3631]: Connected to 1.2.3.4:443
Jan 17 11:17:39 kyle NetworkManager[3631]: SSL negotiation with 1.2.3.4
Jan 17 11:17:39 kyle NetworkManager[3631]: Server certificate verify failed: signer not found
Jan 17 11:17:39 kyle NetworkManager[3631]: Connected to HTTPS on 1.2.3.4 with ciphersuite (TLS1.2)-(ECDHE-SECP256R1)-(RSA-SHA256)-(AES-256-GCM)
Jan 17 11:17:46 kyle NetworkManager[790]: <info>  [1705486666.3772] audit: op="statistics" interface="enp6s0" ifindex=2 args="2000" pid=1205 uid=1000 result="success"
Jan 17 11:17:48 kyle plasmashell[1205]: file:///usr/lib/qt/qml/org/kde/plasma/extras/PlaceholderMessage.qml:238:5: QML Heading: Binding loop detected for property "verticalAlignment"
Jan 17 11:17:49 kyle kwin_wayland[1006]: This plugin does not support raise()
Jan 17 11:18:39 kyle NetworkManager[790]: <warn>  [1705486719.9773] vpn[0x64677478fac0,040f8208-cd33-45b7-8f5a-8805f67317d1,"VPN"]: connect timeout exceeded
Jan 17 11:18:39 kyle nm-openconnect-[3613]: Connect timer expired, disconnecting.
Jan 17 11:18:39 kyle NetworkManager[3631]: TLS/DTLS read cancelled
Jan 17 11:18:39 kyle NetworkManager[3631]: Error reading HTTP response: Interrupted system call
Jan 17 11:18:39 kyle NetworkManager[3631]: Creating SSL connection failed
Jan 17 11:18:39 kyle NetworkManager[3631]: User cancelled (SIGINT/SIGTERM); exiting.

EXPECTED RESULT
When using nmcli the connection goes through right away. The log output looks very similar, it just continues with more connection info instead of the timeout error.

SOFTWARE/OS VERSIONS
Operating System: Arch Linux 
KDE Plasma Version: 5.27.10
KDE Frameworks Version: 5.114.0
Qt Version: 5.15.12
Kernel Version: 6.7.0-arch3-1 (64-bit)
Graphics Platform: Wayland
Processors: 24 × AMD Ryzen 9 5900X 12-Core Processor
Memory: 31.3 GiB of RAM
Graphics Processor: AMD Radeon RX 6800 XT
Manufacturer: Gigabyte Technology Co., Ltd.
Product Name: X570 AORUS ELITE
System Version: -CF

ADDITIONAL INFORMATION
Comment 1 Ben Cooksley 2024-12-23 18:26:00 UTC
Bulk transfer as requested in T17796