<div dir="ltr">Yes I did. Did not help, got same issue.<div><br></div><div>I guess I'll go the way of modifying configure and generating a private .deb file (that sets piddir to be /etc/ipsec.d/run).</div><div><br></div><div>However, when I download deb-src and _WITHOUT_ any change of mine, just rebuild it, I seem to have a test failure:</div><div><br></div><div><div> Running suite 'settings':</div><div> Running case 'get/set_str (basic behavior)': +++++</div><div> Running case 'get/set_bool': ++</div><div> Running case 'get/set_int': ++</div><div> Running case 'get/set_double': ++</div><div> Running case 'get/set_time': ++</div><div> Running case 'section enumerator': +</div><div> Running case 'key/value enumerator': +</div><div> Running case 'include/load_files[_section]': ++-</div><div><b> Failure in 'test_load_files_section': !settings->load_files_section(settings, include1".no", TRUE, "") (suites/test_settings.c:650, i = 0)</b></div></div><div><br></div><div><br></div><div>I even tried disabling running tests by using the following command:<br></div><div>sudo DEB_BUILD_OPTIONS=nocheck debuild -us -uc -b<br></div><div><br></div><div>Does anyone know either (i) How to disable tests or (ii) What the test failure is without any code change whatsoever?</div><div><br></div><div>Thank you.</div><div>Piyush</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 26, 2017 at 5:18 PM, Noel Kuntze <span dir="ltr"><<a href="mailto:noel.kuntze+strongswan-users-ml@thermi.consulting" target="_blank">noel.kuntze+strongswan-users-ml@thermi.consulting</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello Piyush,<br>
<br>
Did you try copying the files, instead of symlinking?<br>
<span class=""><br>
On <a href="tel:27.04.2017%2001" value="+12704201701">27.04.2017 01</a>:04, Piyush Agarwal wrote:<br>
> Hi Noel,<br>
</span><span class="">> Many thanks for the pointer. Your second suggestion might not work though: in addition to changing daemon name, ipsec_starter also looks for an actual daemon with that name which it won't find unless it is indeed "charon" always.<br>
><br>
> My two namespaces here are "gateway" and "relay".<br>
><br>
> a@strongswan3:~/strongswan$ sudo ip netns exec gateway /usr/lib/ipsec/starter --daemon charon_gateway<br>
> Starting strongSwan 5.1.2 IPsec [starter]...<br>
> Disabling charon_gatewaystart option, '/usr/lib/ipsec/charon_<wbr>gateway' not found<br>
><br>
> I then tried to symlink such that /usr/lib/ipsec/charon_gateway and /usr/lib/ipsec/charon_relay are available (and pointing to /usr/lib/ipsec/charon). But that leads to more mess with the daemon getting continuously restarted.<br>
><br>
> a@strongswan3:~/strongswan$ ps aux | grep ipsec<br>
> root 6114 0.1 0.0 15160 1456 ? Ss 22:58 0:00 /usr/lib/ipsec/starter --daemon charon_relay<br>
> root 6253 0.0 0.0 552128 7228 ? Ssl 22:59 0:00 /usr/lib/ipsec/charon_relay --use-syslog<br>
><br>
> a@strongswan3:~/strongswan$ ps aux | grep ipsec<br>
> root 6114 0.1 0.0 15160 1456 ? Ss 22:58 0:00 /usr/lib/ipsec/starter --daemon charon_relay<br>
> root 6535 0.0 0.0 552128 5044 ? Ssl 23:03 0:00 /usr/lib/ipsec/charon_relay --use-syslog<br>
><br>
> Sigh.<br>
><br>
><br>
</span><span class="">> On Wed, Apr 26, 2017 at 3:27 PM, Noel Kuntze <noel.kuntze+strongswan-users-<wbr>ml@thermi.consulting <mailto:<a href="mailto:noel.kuntze%2Bstrongswan-users-ml@thermi.consulting">noel.kuntze+<wbr>strongswan-users-ml@thermi.<wbr>consulting</a>>> wrote:<br>
><br>
> I just took a look at it and it seems you can change the file's name by setting the --daemon[1]<br>
> parameter of ipsec starter.<br>
><br>
</span>> [1] <a href="https://github.com/strongswan/strongswan/blob/master/src/starter/starter.c#L291" rel="noreferrer" target="_blank">https://github.com/strongswan/<wbr>strongswan/blob/master/src/<wbr>starter/starter.c#L291</a> <<a href="https://github.com/strongswan/strongswan/blob/master/src/starter/starter.c#L291" rel="noreferrer" target="_blank">https://github.com/<wbr>strongswan/strongswan/blob/<wbr>master/src/starter/starter.c#<wbr>L291</a>><br>
<span class="">><br>
> On <a href="tel:27.04.2017%2000" value="+12704201700">27.04.2017 00</a> <tel:27.04.2017%2000>:25, Noel Kuntze wrote:<br>
> > Hello Piyush,<br>
> ><br>
> > The path to the PID file is hard coded during build time.<br>
> > Take a look at the source code of starter[1] and track the<br>
> > variable assignments down.<br>
> ><br>
</span>> > [1] <a href="https://github.com/strongswan/strongswan/tree/master/src/starter" rel="noreferrer" target="_blank">https://github.com/strongswan/<wbr>strongswan/tree/master/src/<wbr>starter</a> <<a href="https://github.com/strongswan/strongswan/tree/master/src/starter" rel="noreferrer" target="_blank">https://github.com/<wbr>strongswan/strongswan/tree/<wbr>master/src/starter</a>><br>
> ><br>
> > Kind regards,<br>
> > Noel<br>
<span class="">> ><br>
> > On <a href="tel:27.04.2017%2000" value="+12704201700">27.04.2017 00</a> <tel:27.04.2017%2000>:14, Piyush Agarwal wrote:<br>
> >> Hi Noel,<br>
> >> Thanks for your reply but I am not sure I completely understood your answer.<br>
> >><br>
> >> While waiting for a reply to my question, I tried this though:<br>
> >><br>
> >> 1) Downloaded strongswan-starter deb file. Unpacked it.<br>
> >> 2) Changed IPSEC_PIDDIR in usr/sbin/ipsec file to point to /etc/ipsec.d/run (rather than /var/run)<br>
> >> 3) Re-built the deb file<br>
> >> 4) Installed this new deb file on my ubuntu 14.04 host<br>
> >> 5) Now ipsec binary does report piddir to be the changed location:<br>
> >><br>
> >> a@strongswan3:~$ sudo ip netns exec blue ipsec --piddir<br>
> >> /etc/ipsec.d/run<br>
> >><br>
> >> But charon seems to still think the piddir is /var/run and hence wouldn't start the second instance.<br>
> >><br>
> >> a@strongswan3:~$ sudo ip netns exec red ipsec start<br>
> >> Starting strongSwan 5.1.2 IPsec [starter]...<br>
> >> charon is already running (/var/run/charon.pid exists) -- skipping daemon start<br>
> >> starter is already running (/var/run/starter.charon.pid exists) -- no fork done<br>
> >><br>
> >> So obviously charon is getting its piddir from somewhere else. I am looking for source code to modify such that charon's piddir is not hardcoded to /var/run (as it currently seems to be). I'd like to make it modifiable via either a command line, conf file or some other similar way. Perhaps I may be okay to even hardcode it in my private .deb file to be /etc/ipsec.d/run rather than /var/run.<br>
> >><br>
> >> Is there any pointer to achieving this? Requiring install from source code and modifying ./configure options to change piddir is just a no-go for me unfortunately.<br>
> >><br>
> >> Thank you.<br>
> >> Piyush<br>
> >><br>
</span><span class="">> >> On Wed, Apr 26, 2017 at 11:23 AM, Noel Kuntze <noel.kuntze@thermi.consulting <mailto:<a href="mailto:noel.kuntze@thermi.consulting">noel.kuntze@thermi.<wbr>consulting</a> <mailto:<a href="mailto:noel.kuntze@thermi.consulting">noel.kuntze@thermi.<wbr>consulting</a>>>> wrote:<br>
> >><br>
> >> You can't do that when you start charon using "ipsec" (which implicitely calls "ipsec starter".<br>
> >> You can do it with charon-systemd, though (but then you need to start it using systemd and you get a similiar problem).<br>
> >><br>
</span><span class="">> >> On <a href="tel:26.04.2017%2020" value="+12604201720">26.04.2017 20</a> <tel:26.04.2017%2020> <tel:26.04.2017%2020>:11, Piyush Agarwal wrote:<br>
> >> > Hi,<br>
> >> > I need to run multiple ipsec charon daemons in multiple mininet namespaces (perhaps some semantics change from ip namespaces).<br>
> >> ><br>
</span>> >> > Sure enough, on following steps from <a href="https://wiki.strongswan.org/projects/strongswan/wiki/Netns" rel="noreferrer" target="_blank">https://wiki.strongswan.org/<wbr>projects/strongswan/wiki/Netns</a> <<a href="https://wiki.strongswan.org/projects/strongswan/wiki/Netns" rel="noreferrer" target="_blank">https://wiki.strongswan.org/<wbr>projects/strongswan/wiki/Netns</a><wbr>> <<a href="https://wiki.strongswan.org/projects/strongswan/wiki/Netns" rel="noreferrer" target="_blank">https://wiki.strongswan.org/<wbr>projects/strongswan/wiki/Netns</a> <<a href="https://wiki.strongswan.org/projects/strongswan/wiki/Netns" rel="noreferrer" target="_blank">https://wiki.strongswan.org/<wbr>projects/strongswan/wiki/Netns</a><wbr>>> (including piddir change), I could get multiple charon daemons running with*ip network namespaces*.<br>
<span class="">> >> ><br>
> >> > I am not trying to achieve two things:<br>
> >> > 1) Run multiple charon daemons with mininet namespaces<br>
> >> > 2) Be able to do so without requiring piddir configuration option change.<br>
> >> ><br>
> >> > Regarding (1): I am not sure if mininet namespaces provide for bind mounting anything /etc/netns/<namespace name>/ to /etc/ for the process running in that network namespace -- if it doesn't, I will bind mount manually before starting charon/ipsec. So this should be okay.<br>
> >> ><br>
> >> > But, I am trying to find how I can do away the piddir configuration change and make it work directly from the deb file install. Is there no way to achieve this? No environment variable that can be set?<br>
> >> ><br>
> >> > Appreciate any comments/directions/pointers.<br>
> >> ><br>
> >> > Thank you.<br>
> >> > Piyush<br>
> >> ><br>
> >> ><br>
> >> > --<br>
> >> > Piyush Agarwal<br>
> >> > Life can only be understood backwards; but it must be lived forwards.<br>
> >> ><br>
> >> ><br>
> >> > ______________________________<wbr>_________________<br>
> >> > Users mailing list<br>
</span>> >> > <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.<wbr>strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.<wbr>strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.<wbr>strongswan.org</a>>><br>
> >> > <a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/<wbr>mailman/listinfo/users</a> <<a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/<wbr>mailman/listinfo/users</a>> <<a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/<wbr>mailman/listinfo/users</a> <<a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/<wbr>mailman/listinfo/users</a>>><br>
<span class="im HOEnZb">> >><br>
> >> --<br>
> >> Noel Kuntze<br>
> >> IT security consultant<br>
> >><br>
> >> GPG Key ID: 0x0739AD6C<br>
> >> Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C<br>
> >><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >> --<br>
> >> Piyush Agarwal<br>
> >> Life can only be understood backwards; but it must be lived forwards.<br>
> >><br>
> >><br>
> >> ______________________________<wbr>_________________<br>
> >> Users mailing list<br>
> >> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.<wbr>strongswan.org</a>><br>
> >> <a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/<wbr>mailman/listinfo/users</a> <<a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/<wbr>mailman/listinfo/users</a>><br>
> ><br>
> ><br>
> ><br>
> > ______________________________<wbr>_________________<br>
> > Users mailing list<br>
> > <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.<wbr>strongswan.org</a>><br>
> > <a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/<wbr>mailman/listinfo/users</a> <<a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/<wbr>mailman/listinfo/users</a>><br>
> ><br>
><br>
><br>
><br>
><br>
> --<br>
</span><div class="HOEnZb"><div class="h5">> Piyush Agarwal<br>
> Life can only be understood backwards; but it must be lived forwards.<br>
<br>
<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><span style="font-size:12.8px">Piyush Agarwal</span><br></div><div><span style="color:rgb(17,17,17)"><font face="arial, helvetica, sans-serif" size="2">Life can only be understood backwards; but it must be lived forwards.</font></span><br></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>