IssueTracker

Which hardware is this on?  (Is it missing kernel option for IPv6?)

These logs are generated by original ASUS Google Nexus 7 WiFi [2012]:  it has been just upgraded via OTA with official firmware 4.4 (KRT16S).
I don't know if the kernel option for IPv6 is installed because I've not compiled the kernel but I'm using the official Google version.  
Anyway this issue is common for many users as I can see from the lot of feedbacks I receive from users of my VPN applications.

I've the same issue. Nexus 7, Android 4.4 KitKat.Please fix it soon.

Same problem Nexus 7(2013) android 4.4

Same problem on Nexus 7 with 4.4. I rely on this functionality for connectivity while on  the road. With travel plans just a week away, I'm seriously considering a Windows 8 tablet. There's no way I'll be getting the new Nexus 10 now - not when something as important as this can be broken so easily.

Can you send a full bugreport of the failure to me at rgreenwalt@google.com?

That specific error copypasted in the report is supposed to be innocuous, but there is most likely an underlying problem.
The requested bugreport will help identify the issue.


https://android.googlesource.com/platform/system/netd/+/master/SecondaryTableController.cpp
 around line 474

    //try and set up for ipv6. ipv6 nat came in the kernel only in 3.7, so this can fail
    ret = execIptables(V6,
            "-t",
            "nat",
            add ? "-A" : "-D",
            LOCAL_NAT_POSTROUTING,
            "-o",
            iface,
            "-m",
            "mark",
            "--mark",
            mark_str,
            "-j",
            "MASQUERADE",
            NULL);

I've also got this problem on a Nexus 7 (2012, WLAN only) after the update to Android 4.4 last weekend. This breaks my connectivity while on the road, as I am no longer able to use tethering via Bluetooth to my Samsung smartphone, making the tablet nearly useless away from my home network (open WLAN hotspots are not that common in Germany due to legal difficulties).

I'd really appreciate a fast fix for this problem.

Same here on 4.4 kitkat now nexus useless when out! & lack of adhoc wifi adds insult to injury!

I wiah u fix it soon :)

[Comment deleted]

I've just updated my ASUS Google Nexus 7 WiFi [2012] to android 4.4 KitKat via OTA, and i have the same issue.

I have same problem on Nexus10 after I received official update to 4.4

I have a Nexus tablet 10. After installing Android 4.4 Bluevpn stopped working. Tried to use the TunKo did not help. Help please

I have the same problem too. After upgrading to 4.4 my nexus 7 is now less useful than before.

[Comment deleted]

[Comment deleted]

The VpnService class cannot register the "tun0" interface into the routing table;  I've tested the same code for Android 4.4 and 4.3:

Android 4.4

shell@android:/ $ cat /proc/net/route
cat /proc/net/route
Iface   Destination     Gateway         Flags   RefCnt  Use     Metric  Mask        MTU     Window  IRTT
wlan0   00000000        0100A8C0        0003    0       0       0       00000000        0       0       0
wlan0   00000000        0100A8C0        0003    0       0       305     00000000        0       0       0
wlan0   0000A8C0        00000000        0001    0       0       305     00FFFFFF        0       0       0
wlan0   0100A8C0        00000000        0005    0       0       0       FFFFFFFF        0       0       0


Android 4.3

shell@android:/ $ cat /proc/net/route
cat /proc/net/route
Iface   Destination     Gateway         Flags   RefCnt  Use     Metric  Mask        MTU     Window  IRTT
tun0    00000000        00000000        0001    0       0       0       00000080        0       0       0
wlan0   00000000        0100A8C0        0003    0       0       0       00000000        0       0       0
wlan0   00000000        0100A8C0        0003    0       0       308     00000000        0       0       0
tun0    00000080        00000000        0001    0       0       0       00000080        0       0       0
wlan0   0000A8C0        00000000        0001    0       0       308     00FFFFFF        0       0       0
wlan0   0100A8C0        00000000        0005    0       0       0       FFFFFFFF        0       0       0

I have this same issue with my Google nexus 5. This is a huge feature for me and I'm sure many others. Please fix as soon as possible.

[Comment deleted]

The Linux kernel 3.4.0 was introduced since Android version 4.2 (Jelly Bean); now I've in my Nexus 7 (2012) [firmware KRT16S] the old kernel version 3.1.10-gee1a0b2.   Maybe the issue is due to the kernel regression?  

Is it related to?
https://code.google.com/p/android/issues/detail?id=61948

#22
VPN on Android 4.4 seems to depend on, or at least assume it is run on, a kernel with support for IPv6 NAT, available in Linux kernel 3.7 and later.

Another difference for the same code:

VpnService.Builder builder = new VpnService.Builder();
builder.setMtu(1500);
builder.addAddress("10.0.0.1",24);      
builder.addDnsServer("8.8.8.8");
builder.addDnsServer("8.8.4.4");
builder.addRoute("0.0.0.0", 0);
ParcelFileDescriptor parcel = builder.setSession("VPN Tether Connection").establish();  

Android 4.3:
11-30 12:24:49.458: D/VpnJni(146): Address added on tun0: 10.0.0.1/24
11-30 12:24:49.458: D/VpnJni(146): Route added on tun0: 0.0.0.0/0
11-30 12:24:49.458: I/Vpn(146): Established by com.test_vpn on tun0

Android 4.4:
11-29 17:18:02.925: D/VpnJni(493): Address added on tun0: 10.0.0.1/24
11-29 17:18:03.055: I/ip6tables(120): ip6tables v1.4.11.1: can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?)
11-29 17:18:03.055: I/ip6tables(120): Perhaps ip6tables or your kernel needs to be upgraded.
11-29 17:18:03.055: I/ip6tables(120): ip6tables terminated by exit(3)
11-29 17:18:03.055: E/Netd(120): exec() res=0, status=768 for /system/bin/ip6tables -t nat -A st_nat_POSTROUTING -o tun0 -m mark --mark 60 -j MASQUERADE
11-29 17:18:03.155: I/Vpn(493): Established by com.test_vpn on tun0

The message "Route added on tun0: 0.0.0.0/0" is not in the log:  means that builder.addRoute("0.0.0.0", 0);  has no effect.

Method "addRoute" for class VpnService.Build changed:

version 4.3:

         public Builder addRoute(String sAddress, int prefixLength) {
            InetAddress address = InetAddress.parseNumericAddress(sAddress);
            check(address, prefixLength);

            int offset = prefixLength / 8;
            byte[] bytes = address.getAddress();
            if (offset < bytes.length) {
                for (bytes[offset] <<= prefixLength % 8; offset < bytes.length; ++offset) {
                    if (bytes[offset] != 0) {
                        throw new IllegalArgumentException("Bad address");
                    }
                }
            }
            mRoutes.append(String.format(" %s/%d", address.getHostAddress(), prefixLength));
            return this;
        }

version 4.4:
         public Builder addRoute(String sAddress, int prefixLength) {
            InetAddress address = InetAddress.parseNumericAddress(sAddress);
            check(address, prefixLength);

            int offset = prefixLength / 8;
            byte[] bytes = address.getAddress();
            if (offset < bytes.length) {
                for (bytes[offset] <<= prefixLength % 8; offset < bytes.length; ++offset) {
                    if (bytes[offset] != 0) {
                        throw new IllegalArgumentException("Bad address");
                    }
                }
            }
            mRoutes.add(new RouteInfo(new LinkAddress(address, prefixLength), null));
            return this;
        }
 
Where:  

    public RouteInfo(LinkAddress destination, InetAddress gateway) {
        this(destination, gateway, null);
    }

the "gateway" is null and the "iface" is null for the constructor method:

    /**
     * Constructs a RouteInfo object.
     *
     * If destination is null, then gateway must be specified and the
     * constructed route is either the IPv4 default route <code>0.0.0.0</code>
     * if @gateway is an instance of {@link Inet4Address}, or the IPv6 default
     * route <code>::/0</code> if gateway is an instance of
     * {@link Inet6Address}.
     *
     * destination and gateway may not both be null.
     *
     * @param destination the destination prefix
     * @param gateway the IP address to route packets through
     * @param iface the interface name to send packets on
     */
    public RouteInfo(LinkAddress destination, InetAddress gateway, String iface) {
        if (destination == null) {
            if (gateway != null) {
                if (gateway instanceof Inet4Address) {
                    destination = new LinkAddress(Inet4Address.ANY, 0);
                } else {
                    destination = new LinkAddress(Inet6Address.ANY, 0);
                }
            } else {
                // no destination, no gateway. invalid.
                throw new IllegalArgumentException("Invalid arguments passed in: " + gateway + "," +
                                                   destination);
            }
        }
        if (gateway == null) {
            if (destination.getAddress() instanceof Inet4Address) {
                gateway = Inet4Address.ANY;
            } else {
                gateway = Inet6Address.ANY;
            }
        }
        mHasGateway = (!gateway.isAnyLocalAddress());

        mDestination = new LinkAddress(NetworkUtils.getNetworkPart(destination.getAddress(),
                destination.getNetworkPrefixLength()), destination.getNetworkPrefixLength());
        mGateway = gateway;
        mInterface = iface;
        mIsDefault = isDefault();
        mIsHost = isHost();
    }

I have the same issue after my Nexus 10 was automatically upgraded to Kitkat. BlueVPN connection can be established with my Blackberry phone, but doesn’t have data flow.

I have connected nexus 10 and my mobile phone using BlueVPN. Connection establised, but I cant browse using Chrome  :-( ???

For me (Nexus 10), BlueVPN connects but browsing doesn't work.

This has broken my routine and would appreciate a quick fix!

i  my n7 2012 and i got the very same issue i hope they got fixed as soon as possible  

Whats up with guys at google...scrapping one or the other connectivity options in Android with every major release. Last it was with bluetooth and this time around its with VPN. WTH!!

-N7 2012 user (BlueVPN app unable to process data flow)

I have a Nexus 10. I occasionally connected online with my Nokia N8. Now there's no browsing. It seems to be the same problem as everyone else has - the Adroid 4.4 updating - and very irritating. Please fix as soon as possible.

The KitKat version introduces several bugs on VPN module and other functionalities.
You can perform the downgrade of your Nexus device to the previous Jelly Bean 4.3 version, waiting Google will fix all these issues.  Here are the instructions:

http://productforums.google.com/forum/#!msg/nexus/9B1a9GvqbMs/2kJnY8eQCRAJ

BlueVPN connection not work in my Nexus 4 after update Android to 4.4. I am upset

BlueVPN connection not work in my Nexus 7 after update Android to 4.4. I am upset

There is something wrong in one of these steps:

VpnService.java ( row 471 )

   public ParcelFileDescriptor establish() {
            mConfig.addresses = mAddresses;
            mConfig.routes = mRoutes;

            try {
 ->>           return getService().establishVpn(mConfig);  //  ConnectivityService.establishVpn
            } catch (RemoteException e) {
                throw new IllegalStateException(e);
            }
        }

ConnectivityService.java ( row 3637 )  

    public ParcelFileDescriptor establishVpn(VpnConfig config) {
        throwIfLockdownEnabled();
        int user = UserHandle.getUserId(Binder.getCallingUid());
        synchronized(mVpns) {
 ->>          return mVpns.get(user).establish(config);  //  Vpn.establish
        }
    }          
       
Vpn.java  ( rows  393 / 394 )  

   public synchronized ParcelFileDescriptor establish(VpnConfig config) {
                        ........
            mInterface = interfaze;

            // Fill more values.
            config.user = mPackage;
            config.interfaze = mInterface;
            config.startTime = SystemClock.elapsedRealtime();
            mConfig = config;
            // Set up forwarding and DNS rules.
            mVpnUsers = new SparseBooleanArray();
            token = Binder.clearCallingIdentity();
            try {
->>             mCallback.setMarkedForwarding(mInterface);
->>             mCallback.setRoutes(interfaze, config.routes);     //  ConnectivityService.VpnCallback.setRoutes
                mCallback.override(mInterface, config.dnsServers, config.searchDomains);
                addVpnUserLocked(mUserId);
            } finally {
                Binder.restoreCallingIdentity(token);
            }
        } catch (RuntimeException e) {
            updateState(DetailedState.FAILED, "establish");
            IoUtils.closeQuietly(tun);
            // make sure marked forwarding is cleared if it was set
            try {
                mCallback.clearMarkedForwarding(mInterface);
            } catch (Exception ingored) {
                // ignored
            }
            throw e;
        }
        Log.i(TAG, "Established by " + config.user + " on " + mInterface);
                .............
    }  
       
ConnectivityService.java ( rows 3771 / 3779 )  

        public void setRoutes(String interfaze, List<RouteInfo> routes) {
            for (RouteInfo route : routes) {
                try {
 ->>                mNetd.setMarkedForwardingRoute(interfaze, route);  // NetworkManagementService.setMarkedForwardingRoute
                } catch (RemoteException e) {
                }
            }
        }

        public void setMarkedForwarding(String interfaze) {
            try {
 ->>               mNetd.setMarkedForwarding(interfaze);  // NetworkManagementService.setMarkedForwarding
            } catch (RemoteException e) {
            }
        }
               
NetworkManagementService.java  ( rows 1473 / 1520 )  

    public void setMarkedForwarding(String iface) {
        mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);
        try {
->>        mConnector.execute("interface", "fwmark", "rule", "add", iface);  // NativeDaemonConnector.execute
        } catch (NativeDaemonConnectorException e) {
            throw e.rethrowAsParcelableException();
        }
    }
       
    public void setMarkedForwardingRoute(String iface, RouteInfo route) {
        mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);
        try {
            LinkAddress dest = route.getDestination();
 ->>        mConnector.execute("interface", "fwmark", "route", "add", iface,
                  dest.getAddress().getHostAddress(), dest.getNetworkPrefixLength());  // NativeDaemonConnector.execute
        } catch (NativeDaemonConnectorException e) {
            throw e.rethrowAsParcelableException();
        }
    }  
       
NativeDaemonConnector.java ( row 292 )
       
        public NativeDaemonEvent execute(String cmd, Object... args)
            throws NativeDaemonConnectorException {
->>      final NativeDaemonEvent[] events = executeForList(cmd, args);  // --->>  the native class CommandListener manages the command socket
        if (events.length != 1) {
            throw new NativeDaemonConnectorException(
                    "Expected exactly one response, but received " + events.length);
        }
        return events[0];
    }
       
CommandListener.cpp  ( rows 283 / 309 )  
https://android.googlesource.com/platform/system/netd/+/refs/heads/kitkat-release/CommandListener.cpp
       
        int CommandListener::InterfaceCmd::runCommand(SocketClient *cli, int argc, char **argv) {
                ...............
             //     0       1       2        3          4           5        6      7
        // interface route add/remove iface default/secondary dest    prefix gateway
        // interface fwmark  rule  add/remove    iface
        // interface fwmark  route add/remove    iface        dest    prefix
               
        if (!strcmp(argv[1], "fwmark")) {
            if (!strcmp(argv[2], "rule")) {
                .........
                if (!strcmp(argv[3], "add")) {
->>                 if (!sSecondaryTableCtrl->addFwmarkRule(argv[4])) {     // SecondaryTableController.setFwmarkRule(iface, true)
                        cli->sendMsg(ResponseCode::CommandOkay,"Fwmark rule successfully added", false);  
                    } else {
                        cli->sendMsg(ResponseCode::OperationFailed, "Failed to add fwmark rule", true);
                    }
                }
                                ........
                return 0;
            } else if (!strcmp(argv[2], "route")) {
                .........
                if (!strcmp(argv[3], "add")) {
->>                if (!sSecondaryTableCtrl->addFwmarkRoute(argv[4], argv[5], atoi(argv[6]))) {  // SecondaryTableController.addFwmarkRoute
                        cli->sendMsg(ResponseCode::CommandOkay, "Fwmark route successfully added", false);  
                    } else {
                        cli->sendMsg(ResponseCode::OperationFailed, "Failed to add fwmark route", true);
                    }
                }
                                .......                        
                return 0;
            }
                        ......
                }
                .........
        }

SecondaryTableController.cpp  ( rows 475 / 516+534 )    
https://android.googlesource.com/platform/system/netd/+/refs/heads/kitkat-release/SecondaryTableController.cpp

        int SecondaryTableController::setFwmarkRule(const char *iface, bool add) {
        .........
->>   ret = execIptables(V6,            // NetdConstants.execIptables
            "-t",
            "nat",
            add ? "-A" : "-D",
            LOCAL_NAT_POSTROUTING,
            "-o",
            iface,
            "-m",
            "mark",
            "--mark",
            mark_str,
            "-j",
            "MASQUERADE",
            NULL);
          .......
       
        }
       
        int SecondaryTableController::addFwmarkRoute(const char* iface, const char *dest, int prefix) {
->>     return setFwmarkRoute(iface, dest, prefix, true);
        }
       
       
        int SecondaryTableController::setFwmarkRoute(const char* iface, const char *dest, int prefix,
                                                                                                 bool add) {
                int tableIndex = findTableNumber(iface);
                if (tableIndex == -1) {
                        errno = EINVAL;
                        return -1;
                }
                int mark = tableIndex + BASE_TABLE_NUMBER;
                char mark_str[11] = {0};
                char chain_str[IFNAMSIZ + 18];
                char dest_str[44]; // enough to store an IPv6 address + 3 character bitmask

                snprintf(mark_str, sizeof(mark_str), "%d", mark);
                snprintf(chain_str, sizeof(chain_str), LOCAL_MANGLE_IFACE_FORMAT, iface);
                snprintf(dest_str, sizeof(dest_str), "%s/%d", dest, prefix);
->>     return execIptables(getIptablesTarget(dest),    // NetdConstants.execIptables
                                "-t",
                                "mangle",
                                add ? "-A" : "-D",
                                chain_str,
                                "-d",
                                dest_str,
                                "-j",
                                "MARK",
                                "--set-mark",
                                mark_str,
                                NULL);
        }

NetdConstants.cpp      
https://android.googlesource.com/platform/system/netd/+/refs/heads/kitkat-release/NetdConstants.cpp
       

I just updates to 4.4.1 and it appears to be fixed. Woohoo!!!

I am also facing the same issue after upgrade to 4.4 in my nexus 7.blue VPN is not working.notify me when resolved

So is this fixed in the latest update?

On my nexus 7 (2013) rooted with 4.4.1, it doesn't work.

I'm not confident that the upgrade 4.4.1 will fix the VPN issue, probably we need to wait the new minor updates ( 4.4.2 or 4.4.3 )

I received the OTA update to 4.4.2 tonight. Sadly the VPN problems still persist on my Nexus 7 (2012, 32 GB, WLAN only, unrooted). Guess I'll have to wait for 4.4.3+x then.

[Comment deleted]

I also received 4.4.2 to Nexus10 and no improvement :(

I just upgraded to 4.4.2 (nexus 7 2012) and sadly blue VPN app is still not working properly.  This is a very good app hopefully Google or the app developer will be able to correct this problem soon.

4.4.2 update doesn't provide the fix on BlueVPN issue still!

[Comment deleted]

I've updated my Nexus 7 to version 4.4.2 and I can confirm that the issue is still present.

I received the OTA update to 4.4.2(build KOT49H) tonight.
The VPN problem still persist on my Nexus 7(2012, 16 GB, WLAN only, unrooted).

Fix it faster please.

I also received the OTA 4.4.2 and still have the VPN problem on my 2012 Nexus 7 16GB WLAN only.

Please get off the pot and address this, unless it is by design.

Same comment for me of course.
Why the problem is still present after two new versions???
Is Google listening?

I'm terribly unhappy!!! this is terrible!! Quickly correct errors!!

I thought having a Google tablet was an advantage, but with this problème of vpn, it's really a disadvantage!

Same problem here. VPN is the only way for me to use this phone while at work and it's broken in 4.4.2.  Was working fine before KitKat. WTF Google ?