SOLVED nordvpn crashed after update

[smokyrun]

Hello All,

After updating my gentoo system, the nordvpn application crashed, I use the version 4.1.1, I tried to use prior version (3.20.3) but same issue.
On the logfile of the application there are any information since the update system and any coredump is generated on /var/tmp/core.

I took a look on all syscall of the application when it starts

Code: Select all

strace /etc/init.d/nordvpn start

but I haven't found anyhting conclusive.

Is someone encounter this same problem after update system ?

Thank in advance for your help.

smokyrun

[rab0171610]

smokyrun,
You did not specify how you are installing the Nordvpn app. If it is from an overlay, it may be that the ebuild downloads and installs the binary from Debian as some of them did in the past. Even in Debian based distros, like Ubuntu, the app has had issues and doesn't always work after system updates. This usually lasts until Nord releases another update which can leave the app inoperable for months in some cases.

Since coming back to Gentoo full time several years ago, I decided to use OpenVPN, disable IPV6, and create a kill switch in UFW firewall that prevents any internet traffic that does not go through the VPN tunnel.

It may be outdated and systemd or ubuntu specific in some cases, but you can read a little about the ufw killswitch here:
https://gist.github.com/Necklaces/18b68 ... d90d0cded2
https://www.comparitech.com/blog/vpn-pr ... -with-ufw/

When setting up OpenVPN, you would download one of Nord's openvpn .conf files for the specific server you wish to connect to. Their support is very good and they can help you find these files on their website. OpenVPN starts as a service using your preferred init system.

Otherwise, I would suggest looking at:
https://github.com/NordSecurity/nordvpn-linux
According to their version 4.2.0 release notes:

Code: Select all

    The NordVPN Linux GUI app source code is now public.

The build instructions are here:
https://github.com/NordSecurity/nordvpn ... n/BUILD.md
I don't know if there is an ebuild using this source code yet or if it is still relying on the Debian binaries as it did in the past. I am not able to verify this as Zugaina is down right now and I can't check any possible ebuilds you are using right now. The Debian binaries are often dependent on libraries found in Debian stable and sensitive to system updates and library version changes on other distros including Gentoo and the various Ubuntu versions so they are not very reliable outside of Debian. Debian also was the only supported distro for the NordVPN app at one time so most Gentoo ebuilds installed the Debian binary as that is all that was available but the opensource version, if legitimate, now says on their README:

Code: Select all

Supported distros

    Ubuntu
    Fedora
    Debian
    Kali
    OpenSUSE
    Raspbian

Distributions are not supported after their end of life. 

They also provide instructions for Docker images.

[saellaven]

Code: Select all

ldd /usr/sbin/nordvpnd 
	linux-vdso.so.1 (0x00007f48669c5000)
	libmoosenordvpnapp.so => /usr/lib/nordvpn/libmoosenordvpnapp.so (0x00007f4864e00000)
	libmooseworker.so => /usr/lib/nordvpn/libmooseworker.so (0x00007f4865076000)
	libsqlite3.so.0 => /usr/lib64/libsqlite3.so.0 (0x00007f4864c69000)
	libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f4866970000)
	libquench.so => /usr/lib/nordvpn/libquench.so (0x00007f4864800000)
	libtelio.so => /usr/lib/nordvpn/libtelio.so (0x00007f4863c00000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f4866969000)
	libxml2.so.2 => not found
	libc.so.6 => /lib64/libc.so.6 (0x00007f4863a23000)
	libgcc_s.so.1 => /usr/lib/gcc/x86_64-pc-linux-gnu/14/libgcc_s.so.1 (0x00007f486693b000)
	libm.so.6 => /lib64/libm.so.6 (0x00007f4864baf000)
	libdl.so.2 => /lib64/libdl.so.2 (0x00007f4866934000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f48669c7000)
	libz.so.1 => /usr/lib64/libz.so.1 (0x00007f4866919000)
	libicuio.so.77 => /usr/lib64/libicuio.so.77 (0x00007f4866909000)
	libicui18n.so.77 => /usr/lib64/libicui18n.so.77 (0x00007f4863600000)
	libicuuc.so.77 => /usr/lib64/libicuuc.so.77 (0x00007f4863200000)
	librt.so.1 => /lib64/librt.so.1 (0x00007f4866902000)
	libstdc++.so.6 => /usr/lib/gcc/x86_64-pc-linux-gnu/14/libstdc++.so.6 (0x00007f4862e00000)
	libicudata.so.77 => /usr/lib64/libicudata.so.77 (0x00007f4860e00000)

You're likely missing libxml2.so.2 . As of dev-libs/libxml2-2.14.6 it doesn't seem to get created/linked. This seems to be another switching to meson related issue.

[grknight]

You're likely missing libxml2.so.2 . As of dev-libs/libxml2-2.14.6 it doesn't seem to get created/linked. This seems to be another switching to meson related issue.

If this is true, then install dev-libs/libxml2-compat which is meant to compensate for pre-built binaries looking for that shared library version.

[smokyrun]

Hello Guru,

Thank you so much for your reply and all these information, I will look at the these links, I use this overlay https://gitlab.com/lahouari.dc/nordvpn and I'm almost sure it uses Debian sources to build the ebuild.
You're right by using this kind off installation, after an update system sometimes the application doesn't work fine.

Kind regards

smokyrun

[smokyrun]

Hello saellaven and grknight,

Thank you so much for your help, you're right, the problem come from to the missing of the libxml2.so.2 library but my ldd output doesn't display this missing :

Code: Select all

ldd /usr/bin/nordvpn
	linux-vdso.so.1 (0x00007f1c587d0000)
	libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007f1c579b6000)
	libresolv.so.2 => /usr/lib64/libresolv.so.2 (0x00007f1c579a4000)
	libc.so.6 => /usr/lib64/libc.so.6 (0x00007f1c577b2000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f1c587d2000)

Now after installation of the package dev-libs/libxml2-compat the service nordvpn works fine but I can't access to internet, I think the problem comes from to the /etc/resolv.conf, it seems nordvpn can't write inside.

On my Debian Trixie this file looks like :

Code: Select all

willy@vulcain:~$ cat /etc/resolv.conf 

# Generated by NordVPN
nameserver 103.86.99.100
nameserver 103.86.96.100

willy@vulcain:~$ lsattr /etc/resolv.conf 
----i----------------- /etc/resolv.conf

On my gentoo :

Code: Select all

willy@himalaya /etc # lsattr /etc/resolv.conf
---------------------- /etc/resolv.conf

willy@himalaya /etc # cat /etc/resolv.conf
#restored
nameserver 192.168.1.1

I noticed since the update system the dhcpcd service takes longer to start :

willy@himalaya /etc # cat dhcpcd.conf

Code: Select all

# A sample configuration for dhcpcd.
# See dhcpcd.conf(5) for details.

# Allow users of this group to interact with dhcpcd via the control socket.
#controlgroup wheel

# Inform the DHCP server of our hostname for DDNS.
#hostname

# Use the hardware address of the interface for the Client ID.
#clientid
# or
# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
# Some non-RFC compliant DHCP servers do not reply with this set.
# In this case, comment out duid and enable clientid above.
duid

# Persist interface configuration when dhcpcd exits.
persistent

# vendorclassid is set to blank to avoid sending the default of
# dhcpcd-<version>:<os>:<machine>:<platform>
vendorclassid

# A list of options to request from the DHCP server.
option domain_name_servers, domain_name, domain_search
option classless_static_routes
# Respect the network MTU. This is applied to DHCP routes.
option interface_mtu

# Request a hostname from the network
option host_name

# Most distributions have NTP support.
#option ntp_servers

# Rapid commit support.
# Safe to enable by default because it requires the equivalent option set
# on the server to actually work.
option rapid_commit

# A ServerID is required by RFC2131.
require dhcp_server_identifier

# Generate SLAAC address using the Hardware Address of the interface
#slaac hwaddr
# OR generate Stable Private IPv6 Addresses based from the DUID
slaac private

# prevent dhcpcd to not run the resolv.conf 'hook'
[b]nohook resolv.conf[/b]

# Disable IPV6
[b]noipv6[/b]

Kind regards,

smokyrun

[smokyrun]

Hello All,

I succeeded to fix the problem of nordvpn, below all actions done :

-installation of package dev-libs/libxml2-compat suggested by grknight
-remove directive "

Code: Select all

nohook resolv.conf"

in

Code: Select all

/etc/dhcpcd.conf

-just after installation I disabled the option "

Code: Select all

killswitch

" in nordvpn config to allow login, otherwise I did'nt access to internet

I take a look about the killswitch functionnality, I think it was a good idea to reactivated it and now everything is working fine on my system.

My nordvpn config looks like :

Code: Select all

willy@himalaya ~ $ nordvpn settings
Technology: NORDLYNX
Firewall: enabled
Firewall Mark: 0xe1f1
Routing: enabled
User Consent: disabled
Kill Switch: enabled
Threat Protection Lite: disabled
Notify: enabled
Tray: enabled
Auto-connect: enabled
Meshnet: disabled
DNS: disabled
LAN Discovery: disabled
Virtual Location: enabled
Post-quantum VPN: disabled
Allowlisted ports:
           22 (UDP|TCP)
          161 (UDP|TCP)
          443 (UDP|TCP)
          515 (UDP|TCP)
          631 (UDP|TCP)
         1194 (UDP|TCP)
Allowlisted subnets:
	x.x.x.x/24

Hope that can help someone who encounters the same issue.

smokyrun

[rab0171610]

Smokyrun,
I am glad you got it working again.

Should the overlay maintainer be notified to consider adding dev-libs/libxml2-compat as an RDEPEND in the ebuild? I notice the latest ebuild currently has:

Code: Select all

# TODO: verify that list of RDEPEND is complete

The latest ebuilds are currently still using the debian binary:

Code: Select all

SRC_URI="https://repo.nordvpn.com/deb/nordvpn/debian/pool/main/n/nordvpn/nordvpn_${MY_PV}_amd64.deb"

I am curious if anyone is currently working on an ebuild that builds the nordvpn app natively now the source code has been released. I am assuming the missing libxml2.so.2 would no longer be an issue if was built from source?

Maybe someone with more skills and experience than I would be able to write an ebuild for this.

https://github.com/NordSecurity/nordvpn ... n/BUILD.md