Mac OSx Lion - lladdr problem

crazymind

Hey guys,

there is a strange behavior with Mac OSx Lion and OpenVPN. I want to configure a mac-address in opvn.conf via lladdr xx:xx.... If I start the client and the dhcp-request was send, I can see in tcpdump (at server and client) a wrong / random mac-address was send with the dhcp-req. My dhcp-server answers the req with a reply but the client does not accept it because tap0 does have the configured mac-address from the ovpn.conf. Deleting the lladdr from config = everthing wents fine. With Ubuntu / Gentoo / Windows clients everything is fine with using lladdr.

I think that can be caused by 2 different things. First is that there is something wrong with openvpn / tuntap and mac OSx lion. The second could be a problem with tun/tap and the dhcp-client from mac OSx lion.

Does anybody heard about that issue (perhaps with a workarround).

Regards,
Mike

server:
- 2.6.38-gentoo-r1 i686
- openvpn-2.1.4
- dnsmasq-2.57 (DHCP / DNS)

client:
- MacBook Pro
- OSx Lion 11.2.0 Darwin Kernel Version 11.2.0 x86_64
mac:~ root# /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn --version
OpenVPN 2.2.1 i386-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on Sep 14 2011
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

$ ./configure --with-lzo-headers=../../../lzo-2.05/staging/include --with-lzo-lib=../../../lzo-2.05/staging/lib --with-pkcs11-helper-headers=../../../pkcs11-helper-1.09/staging/include --with-pkcs11-helper-lib=../../../pkcs11-helper-1.09/staging/lib --with-ssl-headers=/Users/jonathanbullard/Documents/Development/Tunnelblick/R3000-1793a-NoTuntapLogging-Built/third_party/build/staging/openssl-1.0.0e/include/i386 --with-ssl-lib=/Users/jonathanbullard/Documents/Development/Tunnelblick/R3000-1793a-NoTuntapLogging-Built/third_party/build/staging/openssl-1.0.0e/lib --disable-dependency-tracking

Compile time defines: ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_PKCS11 USE_SS

Mimiko

When you start OpenVPN see the MAC address received by the TAP adapter even it does not receive any IP address. So to identify it's a OpenVPN - TAP adapter problem or not.

crazymind

Yes I see ovpn is configuring the mac-address to the tap0 device and also at "ifconfig tap0". I also configured in the scripts a delay for starting with dhcp-request.

Mimiko

Using tcpdump on dhcp-server can you identify the MAC received and is it equal with the one specified?

crazymind

No it is not from any other device on the mac or on the server. Perhaps it is the random mac-address from the tap0 device before changing to the configured lladdr? I made a list of all dumped mac-addresses. (A list of 21 mac-address / one per ovpn start).

crazymind

Hm does noone have an idea? 🙁

Mimiko

The thinking is that the tun is brought up, the system sends a request for ip and in same time OpenVPN configures mac, then a dhcp respoce comes. So it is needed to configure mac by OpenVPN before the system sends a request for ip. I do't know how it is working on Mac. May be some tweaking is needed. Or configuring manually mac address on tap adapter before even starting OpenVPN.

crazymind

The dhcp-request was always sent after everything is configured. I checked that many times. The device did always already have the given lladdr from ovpn when dhcp-req was send.

If I configure ovpn / the tap device to sent the dhcp-request not automatically - that I am able to sent the request manually via termianal, I can see the same behavior. Always a random mac-addr is sent. (always the same mac per ovpn-connect / tap0 creation).

Mimiko

Then you have a problem with the Mac. Check on other mac the behavior. If it will be the same then may be a bug in Mac, where on dinamic MAC assignement, the MAC address is taken from elsewhere.

crazymind

Same problem on other mac