Re: v1.43 - BUG: Connectivity failure when router provides invalid PAC settings

Scott,

You may be interested in this patch series:

https://lore.kernel.org/connman/[email protected]/T/#t

Our solution was to enable the PACrunner daemon as follows and the PACrunner plugin (which seems to recognize it’s an invalid PAC URL and returns “Direct”):

PKG_CONFIG_LIBDIR="$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/glib/usr/lib/pkgconfig:$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/dbus/usr/lib/pkgconfig:$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/curl/usr/lib/pkgconfig" \
$(PROJECT_ROOT)/third_party/pacrunner/repo/configure -C \
AR="$(SYSROOT)/usr/bin/arm-dey-linux-gnueabi/arm-dey-linux-gnueabi-ar" CPP="$(SYSROOT)/usr/bin/arm-dey-linux-gnueabi/arm-dey-linux-gnueabi-cpp" CC="$(SYSROOT)/usr/bin/arm-dey-linux-gnueabi/arm-dey-linux-gnueabi-gcc" CXX="$(SYSROOT)/usr/bin/arm-dey-linux-gnueabi/arm-dey-linux-gnueabi-g++" RANLIB="$(SYSROOT)/usr/bin/arm-dey-linux-gnueabi/arm-dey-linux-gnueabi-ranlib" STRIP="$(SYSROOT)/usr/bin/arm-dey-linux-gnueabi/arm-dey-linux-gnueabi-strip" \
CPPFLAGS="--sysroot=$(PROJECT_ROOT)/rootfs -mcpu=cortex-a8 -mfloat-abi=hard -mfpu=neon -isystem /opt/fwds/sysroots/cortexa9t2hf-neon-dey-linux-gnueabi/usr/include -I$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/linux/linux-dey/include -I$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/curl/usr/include" \
CFLAGS="--sysroot=$(PROJECT_ROOT)/rootfs -mcpu=cortex-a8 -mfloat-abi=hard -mfpu=neon -fno-omit-frame-pointer -fno-strict-aliasing" \
CURL_CFLAGS="" \
CURL_LIBS="-L$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/curl/usr/lib/ -lcurl" \
DBUS_CFLAGS="-I$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/dbus/usr/include/dbus-1.0 -I$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/dbus/usr/lib/dbus-1.0/include" \
DBUS_LIBS="-L$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/dbus/usr/lib/ -ldbus-1" \
GLIB_CFLAGS="-I$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/glib/usr/include/gio-unix-2.0 -I$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/glib/usr/include/glib-2.0 -I$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/glib/usr/lib/glib-2.0/include" \
GLIB_LIBS="-L$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/glib/usr/lib/ -lglib-2.0 -Wl,-rpath-link -Wl,$(PROJECT_ROOT)/results/$(PRODUCT_CONFIG)/digi/dey/8.2.0/$(BUILD_CONFIG)/third_party/pcre/usr/lib" \
--with-sysroot=$(PROJECT_ROOT)/rootfs \
--build=x86_64-pc-linux-gnu \
--host=arm-dey-linux-gnueabi \
--target=arm-dey-linux-gnueabi \
--disable-debug \
--disable-duktape \
--disable-test \
--disable-unit \
--enable-curl \
--prefix=/usr \
--sysconfdir=/etc \
--localstatedir=/var

Best,

Grant

-- 
Principal
Nuovations

[email protected]
https://www.nuovations.com/


> On Jan 27, 2025, at 3:44 PM, Scott Valentine <[email protected]> wrote:
> 
> Apologies for the repeat - I lost the subject line so I am resending.
> 
> While testing an upgrade from v1.33 to v1.43, we experienced an issue
> where some of our devices were failing to establish internet
> connectivity, while the older version of connman had no problems.
> 
> We have identified the source of the issue as a buggy proxy
> configuration from the ISP provided router. Specifically, these are
> Hawaiian Telecom provided Zyxel wireless routers. The router DHCP
> server supplies a PAC URL option with essentially an empty value of
> [0x0a, 0x0d, 0x00], as well as a domain name option of "home".
> 
> This ultimately results in a call to __connman_wpad_start() with an
> invalid configuration that should not succeed (I think?), but does
> (due to the hostname also being set by the DHCP server), even though
> the PAC URL is null.
> 
> WPAD then calls __connman_service_set_proxy_autoconfig() which results
> in the following broken configuration for the service proxy:
>            dict entry(
>               string "Proxy"
>               variant                   array [
>                     dict entry(
>                        string "URL"
>                        variant                            string
> "http://wpad.home/wpad.dat"
>                     )
>                     dict entry(
>                        string "Method"
>                        variant                            string "auto"
>                     )
>                  ]
>            )
> 
> I believe the correct fix for this could be to check the PAC URL
> either before starting WPAD, or within __connman_wpad_start(), the
> latter requiring a getter for the service->pac property. N.B. I don't
> really know much of anything about WPAD or PAC.
> 
> For now, I can work around the issue with a small patch to force the
> proxy method to "direct" in service.c: check_proxy_setup, but I'm not
> super confident that this is the best approach:
> 
> diff -uNrp old/src/service.c new/src/service.c
> --- old/src/service.c   2024-09-01 23:34:15.000000000 -1000
> +++ new/src/service.c   2025-01-27 13:11:52.713053125 -1000
> @@ -1731,8 +1731,18 @@ static bool check_proxy_setup(struct con
>         * to AUTO with an empty URL.
>         */
> 
> -       if (service->proxy != CONNMAN_SERVICE_PROXY_METHOD_UNKNOWN)
> +       DBG("proxy %d, config %d, pac %s", service->proxy,
> service->proxy_config,
> +                       service->pac);
> +
> +       if (service->proxy != CONNMAN_SERVICE_PROXY_METHOD_UNKNOWN) {
> +               if ((service->proxy == CONNMAN_SERVICE_PROXY_METHOD_AUTO) &&
> +                               (service->pac == NULL)) {
> +                       DBG("OVERRIDING PROXY METHOD");
> +                       connman_service_set_proxy_method(service,
> +                               CONNMAN_SERVICE_PROXY_METHOD_DIRECT);
> +                }
>                return true;
> +       }
> 
>        if (service->proxy_config != CONNMAN_SERVICE_PROXY_METHOD_UNKNOWN &&
>                (service->proxy_config != CONNMAN_SERVICE_PROXY_METHOD_AUTO ||
> 
> 
> Mahalo!
> -Scott V.