VPN client bug

[davidstoll]

If your username (email) contains special characters (specifically the + character), the router out not log in (Error - Authentication failure!


My router is: RT-AC88U
I'm using the latest firmware: 384.7_2
OpenVPN client account: nordvpn, who verified this

Log:
Nov 12 07:48:02 ovpn-client1[15984]: OpenVPN 2.4.6 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Oct 21 2018
Nov 12 07:48:02 ovpn-client1[15984]: library versions: OpenSSL 1.0.2p 14 Aug 2018, LZO 2.08
Nov 12 07:48:02 ovpn-client1[15985]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 12 07:48:02 ovpn-client1[15985]: Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Nov 12 07:48:02 ovpn-client1[15985]: Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Nov 12 07:48:02 ovpn-client1[15985]: TCP/UDP: Preserving recently used remote address: [AF_INET]181.215.110.229:1194
Nov 12 07:48:02 ovpn-client1[15985]: Socket Buffers: R=[122880->122880] S=[122880->122880]
Nov 12 07:48:02 ovpn-client1[15985]: UDP link local: (not bound)
Nov 12 07:48:02 ovpn-client1[15985]: UDP link remote: [AF_INET]181.215.110.229:1194
Nov 12 07:48:02 ovpn-client1[15985]: TLS: Initial packet from [AF_INET]181.215.110.229:1194, sid=69278025 aef25b4c
Nov 12 07:48:02 ovpn-client1[15985]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 12 07:48:02 ovpn-client1[15985]: VERIFY OK: depth=1, C=PA, ST=PA, L=Panama, O=NordVPN, OU=NordVPN, CN=us867.nordvpn.com, name=NordVPN, emailAddress=cert@nordvpn.com
Nov 12 07:48:02 ovpn-client1[15985]: VERIFY KU OK
Nov 12 07:48:02 ovpn-client1[15985]: Validating certificate extended key usage
Nov 12 07:48:02 ovpn-client1[15985]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Nov 12 07:48:02 ovpn-client1[15985]: VERIFY EKU OK
Nov 12 07:48:02 ovpn-client1[15985]: VERIFY OK: depth=0, C=PA, ST=PA, L=Panama, O=NordVPN, OU=NordVPN, CN=us867.nordvpn.com, name=NordVPN, emailAddress=cert@nordvpn.com
Nov 12 07:48:04 ovpn-client1[15985]: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Nov 12 07:48:04 ovpn-client1[15985]: [us867.nordvpn.com] Peer Connection Initiated with [AF_INET]181.215.110.229:1194
Nov 12 07:48:05 ovpn-client1[15985]: SENT CONTROL [us867.nordvpn.com]: 'PUSH_REQUEST' (status=1)
Nov 12 07:48:05 ovpn-client1[15985]: AUTH: Received control message: AUTH_FAILED
Nov 12 07:48:05 ovpn-client1[15985]: SIGTERM[soft,auth-failure] received, process exiting

 

[sfx2000]

https://www.snbforums.com/threads/f...names-ssid-passwords-hostnames-domains.31273/

 

[davidstoll]

https://www.snbforums.com/threads/f...names-ssid-passwords-hostnames-domains.31273/

That link doesn't reference the plus character. I'm not exactly sure what you wanted me to see there, but if you could elaborate, I would appreciate it.

 

[Xentrk]

That link doesn't reference the plus character. I'm not exactly sure what you wanted me to see there, but if you could elaborate, I would appreciate it.

NOTE - plus sign (+) It is valid for email and SMTP transport for username, e.g. "username+item@example.org" - as an identifier for items outside of email, it's up to the application developer to case this, as "+" (plus sign) can mean things in code if not handled correctly, similar to the exceptions noted above

The point being a plus sign can mean different things depending on the code treatment of the plus sign.

Also, helps to enclose code snips and log file output in

A code tag

for improved readability. It is the icon on the left side of the disk icon.

 

[davidstoll]

Nov 12 07:48:02 ovpn-client1[15984]: OpenVPN 2.4.6 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Oct 21 2018
Nov 12 07:48:02 ovpn-client1[15984]: library versions: OpenSSL 1.0.2p 14 Aug 2018, LZO 2.08
Nov 12 07:48:02 ovpn-client1[15985]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 12 07:48:02 ovpn-client1[15985]: Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Nov 12 07:48:02 ovpn-client1[15985]: Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Nov 12 07:48:02 ovpn-client1[15985]: TCP/UDP: Preserving recently used remote address: [AF_INET]181.215.110.229:1194
Nov 12 07:48:02 ovpn-client1[15985]: Socket Buffers: R=[122880->122880] S=[122880->122880]
Nov 12 07:48:02 ovpn-client1[15985]: UDP link local: (not bound)
Nov 12 07:48:02 ovpn-client1[15985]: UDP link remote: [AF_INET]181.215.110.229:1194
Nov 12 07:48:02 ovpn-client1[15985]: TLS: Initial packet from [AF_INET]181.215.110.229:1194, sid=69278025 aef25b4c
Nov 12 07:48:02 ovpn-client1[15985]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 12 07:48:02 ovpn-client1[15985]: VERIFY OK: depth=1, C=PA, ST=PA, L=Panama, O=NordVPN, OU=NordVPN, CN=us867.nordvpn.com, name=NordVPN, emailAddress=cert@nordvpn.com
Nov 12 07:48:02 ovpn-client1[15985]: VERIFY KU OK
Nov 12 07:48:02 ovpn-client1[15985]: Validating certificate extended key usage
Nov 12 07:48:02 ovpn-client1[15985]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Nov 12 07:48:02 ovpn-client1[15985]: VERIFY EKU OK
Nov 12 07:48:02 ovpn-client1[15985]: VERIFY OK: depth=0, C=PA, ST=PA, L=Panama, O=NordVPN, OU=NordVPN, CN=us867.nordvpn.com, name=NordVPN, emailAddress=cert@nordvpn.com
Nov 12 07:48:04 ovpn-client1[15985]: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Nov 12 07:48:04 ovpn-client1[15985]: [us867.nordvpn.com] Peer Connection Initiated with [AF_INET]181.215.110.229:1194
Nov 12 07:48:05 ovpn-client1[15985]: SENT CONTROL [us867.nordvpn.com]: 'PUSH_REQUEST' (status=1)
Nov 12 07:48:05 ovpn-client1[15985]: AUTH: Received control message: AUTH_FAILED
Nov 12 07:48:05 ovpn-client1[15985]: SIGTERM[soft,auth-failure] received, process exiting

 

[RMerlin]

The auth-user-pass file generated by Asuswrt-Merlin for OpenVPN does properly show the plus sign when I test with such a username, therefore the problem is not with Asuswrt-Merlin.