<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.E-MailFormatvorlage20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Ther’s no „CHILD SA established“ message in my Up/Down output below.<br>
I think that’s the problem. My wrong assumption was updown is called if IKE SA is established.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>Von:</b> Noel Kuntze <noel.kuntze+strongswan-users-ml@thermi.consulting>
<br>
<b>Gesendet:</b> Donnerstag, 28. November 2019 18:11<br>
<b>An:</b> Thomas Rudolph <rudt@teleconnect.de>; users@lists.strongswan.org<br>
<b>Betreff:</b> Re: [strongSwan] updown script not called<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Add something like `logger foo` below the shebang in the script. You could also use nsenter to get into the namespaces of charon when running under systemd to check if you can execute the file.<o:p></o:p></p>
<p>On the topic of that: How are you running strongSwan? And what is the output of `swanctl --stats`?
<o:p></o:p></p>
<p>Am 28.11.19 um 17:06 schrieb Thomas Rudolph: <br>
> _updown is original file from recent strongSwan distribution. <br>
> Charon runs as root. <br>
> I only addes one echo to one file in /tmp. <br>
> <br>
> <br>
> But, now I see ... updown is in child section, and I only did Up/Down for IKE-SA, is
<br>
> hat my failure ? <br>
> <br>
> -----Ursprüngliche Nachricht----- <br>
> Von: Users <<a href="mailto:users-bounces@lists.strongswan.org">users-bounces@lists.strongswan.org</a>> Im Auftrag von Christoph Harder
<br>
> Gesendet: Donnerstag, 28. November 2019 18:02 <br>
> An: <a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a> <br>
> Betreff: Re: [strongSwan] updown script not called <br>
> <br>
> Hello Thomas, <br>
> <br>
> you could try it without parameters e.g. <br>
> updown = /usr/local/libexec/ipsec/_updown <br>
> <br>
> The updown script is called by the user that runs strongswan e.g. the user 'ipsec', in case you're trying to log something from within the updown-script it will not log into the console (at least it didn't work for me, but logging to syslog worked).<o:p></o:p></p>
<p>> <br>
> Best regards, <br>
> Christoph <br>
> <br>
> TELCO TECH GmbH <br>
> Niederlassung Berlin <br>
> Mädewalder Weg 2 <br>
> 12621 Berlin <br>
> Tel.: +49 30 565862610 <br>
> Web: <a href="http://www.telco-tech.de">www.telco-tech.de</a> <br>
> Amtsgericht Potsdam-Stadt HRB 55 79 <br>
> Geschäftsführung: <br>
> Bernd Schulz <br>
> Silke Schirmer <br>
> <br>
> Am 28.11.19 um 16:53 schrieb Thomas Rudolph: <br>
>> It must be something very simple and stupid I'm doing wrong, on several machines all the same, updown-script is not called.<o:p></o:p></p>
<p>>> <br>
>> Config: <br>
>> <br>
>> connections { <br>
>> <br>
>> conn1 { <br>
>> local_addrs = 200.10.10.2 <br>
>> remote_addrs = 200.10.10.1 <br>
>> local { <br>
>> auth = psk <br>
>> id = 200.10.10.2 <br>
>> } <br>
>> remote { <br>
>> auth = psk <br>
>> id = 200.10.10.1 <br>
>> } <br>
>> children { <br>
>> child1 { <br>
>> local_ts = 192.168.0.0/24 <br>
>> remote_ts = 192.168.2.0/24 <br>
>> updown = /usr/local/libexec/ipsec/_updown iptables <br>
>> esp_proposals = aes256gcm16-sha512 <br>
>> } <br>
>> } <br>
>> version = 2 <br>
>> mobike = no <br>
>> proposals = aes128-aescmac-prfsha1-modp2048 <br>
>> } <br>
>> } <br>
>> <br>
>> secrets { <br>
>> ike1 { <br>
>> ida = 200.10.10.2 <br>
>> idb = 200.10.10.1 <br>
>> secret = ..... <br>
>> } <br>
>> } <br>
>> <br>
>> Up/Down sequence <br>
>> <br>
>> root@strongswan:/home/rudt/projects/vpn-server# swanctl -i --ike conn1 <br>
>> [IKE] initiating IKE_SA conn1[16] to 200.10.10.1 [ENC] generating <br>
>> IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) <br>
>> N(HASH_ALG) N(REDIR_SUP) ] [NET] sending packet: from 200.10.10.2[500] <br>
>> to 200.10.10.1[500] (462 bytes) [NET] received packet: from <br>
>> 200.10.10.1[500] to 200.10.10.2[500] (470 bytes) [ENC] parsed <br>
>> IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) <br>
>> N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ] [CFG] selected <br>
>> proposal: IKE:AES_CBC_128/AES_CMAC_96/PRF_HMAC_SHA1/MODP_2048 <br>
>> [IKE] authentication of '200.10.10.2' (myself) with pre-shared key <br>
>> [ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH <br>
>> N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ] [NET] sending packet: <br>
>> from 200.10.10.2[500] to 200.10.10.1[500] (156 bytes) [NET] received <br>
>> packet: from 200.10.10.1[500] to 200.10.10.2[500] (124 bytes) [ENC] <br>
>> parsed IKE_AUTH response 1 [ IDr AUTH N(FAIL_CP_REQ) ] [IKE] <br>
>> authentication of '200.10.10.1' with pre-shared key successful [IKE] <br>
>> IKE_SA conn1[16] established between <br>
>> 200.10.10.2[200.10.10.2]...200.10.10.1[200.10.10.1] <br>
>> [IKE] scheduling rekeying in 13670s <br>
>> [IKE] maximum IKE_SA lifetime 15110s <br>
>> initiate completed successfully <br>
>> root@strongswan:/home/rudt/projects/vpn-server# swanctl -t --ike conn1 <br>
>> [IKE] deleting IKE_SA conn1[16] between <br>
>> 200.10.10.2[200.10.10.2]...200.10.10.1[200.10.10.1] <br>
>> [IKE] sending DELETE for IKE_SA conn1[16] [ENC] generating <br>
>> INFORMATIONAL request 2 [ D ] [NET] sending packet: from <br>
>> 200.10.10.2[500] to 200.10.10.1[500] (76 bytes) [NET] received packet: <br>
>> from 200.10.10.1[500] to 200.10.10.2[500] (76 bytes) [ENC] parsed <br>
>> INFORMATIONAL response 2 [ ] [IKE] IKE_SA deleted terminate completed <br>
>> successfully root@strongswan:/home/rudt/projects/vpn-server# <br>
>> <br>
>> <br>
>> and no updown-script called. <br>
>> <br>
>> Can someone please enlighten me .. <br>
>> <br>
>> <br>
>> -----Ursprüngliche Nachricht----- <br>
>> Von: Users <<a href="mailto:users-bounces@lists.strongswan.org">users-bounces@lists.strongswan.org</a>> Im Auftrag von Thomas
<br>
>> Rudolph <br>
>> Gesendet: Donnerstag, 28. November 2019 17:14 <br>
>> An: <a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a>
<br>
>> Betreff: Re: [strongSwan] updown script not called <br>
>> <br>
>> Hello Christoph, <br>
>> <br>
>> it is an absolute path. <br>
>> <br>
>> -----Ursprüngliche Nachricht----- <br>
>> Von: Users <<a href="mailto:users-bounces@lists.strongswan.org">users-bounces@lists.strongswan.org</a>> Im Auftrag von
<br>
>> Christoph Harder <br>
>> Gesendet: Donnerstag, 28. November 2019 17:06 <br>
>> An: <a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a>
<br>
>> Betreff: Re: [strongSwan] updown script not called <br>
>> <br>
>> Hello Thomas, <br>
>> <br>
>> to which value did you set the updown variable / which path did you use? <br>
>> Is it a relative path or an absolute path to the updown script? <br>
>> <br>
>> Best regards, <br>
>> Christoph Harder <br>
>> <br>
>> TELCO TECH GmbH <br>
>> Niederlassung Berlin <br>
>> Mädewalder Weg 2 <br>
>> 12621 Berlin <br>
>> Tel.: +49 30 565862610 <br>
>> Web: <a href="http://www.telco-tech.de">www.telco-tech.de</a> <br>
>> Amtsgericht Potsdam-Stadt HRB 55 79 <br>
>> Geschäftsführung: <br>
>> Bernd Schulz <br>
>> Silke Schirmer <br>
>> <br>
>> Am 28.11.19 um 16:02 schrieb Thomas Rudolph: <br>
>>> Hi, <br>
>>> <br>
>>> please help, I try to use custom updown script in swanctl.conf child <br>
>>> section. <br>
>>> <br>
>>> I only replaced original _updown with path to own script. <br>
>>> <br>
>>> * Updown plugin is loaded <br>
>>> * CHILDSA comes up/down successful <br>
>>> * Script is executable and from everyone accessible <br>
>>> <br>
>>> Regards, <br>
>>> <br>
>>> Thomas <br>
>>> <br>
>>> . -- <br>
>>> Thomas Rudolph <br>
>>> Teleconnect GmbH <br>
>>> Am Lehmberg 54, 01157 Dresden, Germany <br>
>>> <br>
>>> Phone: +49 351 4236 214 (Main: - 210) <br>
>>> E-Mail/Skype: <a href="mailto:rudt@teleconnect.de">rudt@teleconnect.de</a> <<a href="mailto:rudt@teleconnect.de">mailto:rudt@teleconnect.de</a>>
<br>
>>> <br>
>>> <br>
>>> <br>
>>> Watch our current video! <br>
>>> <<a href="https://www.youtube.com/watch?v=YtFrOo9rzSU">https://www.youtube.com/watch?v=YtFrOo9rzSU</a>>
<br>
>>> <br>
>>> Teleconnect <<a href="https://www.teleconnect.de">https://www.teleconnect.de</a>> Twitter
<br>
>>> <<a href="https://twitter.com/Teleconnect_">https://twitter.com/Teleconnect_</a>> Linkedin
<br>
>>> <<a href="https://www.linkedin.com/company/teleconnect-gmbh/">https://www.linkedin.com/company/teleconnect-gmbh/</a>>
<br>
>>> <br>
>>> USt.-IdNr. (VAT ID): DE140301522 <br>
>>> Registergericht (Commercial registry): Dresden, HRB 1040 <br>
>>> Geschäftsführer (Managing Director): Dr. Gerald Nürnberger <br>
>>> --------------------------------------------------------------------- <br>
>>> - <br>
>>> -- Der Inhalt dieser Mail enthält möglicherweise vertrauliche <br>
>>> Informationen und ist ausschließlich für den bezeichneten Adressaten <br>
>>> bestimmt. Wenn Sie nicht der richtige Adressat sind, teilen Sie dem <br>
>>> Absender bitte den Erhalt der Mail mit und löschen Sie die Mail. <br>
>>> The content of this mail may contain confidential information and is <br>
>>> intended solely for the designated addressee. If you are not the <br>
>>> intended addressee, then please inform the sender about the receipt <br>
>>> of this mail and delete the mail. <br>
>> . <br>
>> -- <br>
>> Thomas Rudolph <br>
>> Teleconnect GmbH <br>
>> Am Lehmberg 54, 01157 Dresden, Germany <br>
>> <br>
>> Phone: +49 351 4236 214 (Main: - 210) <br>
>> E-Mail/Skype: rudt@teleconnect.de<<a href="mailto:rudt@teleconnect.de">mailto:rudt@teleconnect.de</a>>
<br>
>> <br>
>> <br>
>> Watch our current video! <br>
>> <<a href="https://www.youtube.com/watch?v=YtFrOo9rzSU">https://www.youtube.com/watch?v=YtFrOo9rzSU</a>>
<br>
>> <br>
>> Teleconnect <<a href="https://www.teleconnect.de">https://www.teleconnect.de</a>> Twitter <<a href="https://twitter.com/Teleconnect_">https://twitter.com/Teleconnect_</a>> Linkedin <<a href="https://www.linkedin.com/company/teleconnect-gmbh/">https://www.linkedin.com/company/teleconnect-gmbh/</a>><o:p></o:p></p>
<p>>> <br>
>> USt.-IdNr. (VAT ID): DE140301522 <br>
>> Registergericht (Commercial registry): Dresden, HRB 1040 Geschäftsführer (Managing Director): Dr. Gerald Nürnberger ________________________________ Der Inhalt dieser Mail enthält möglicherweise vertrauliche Informationen und ist ausschließlich für den bezeichneten
Adressaten bestimmt. Wenn Sie nicht der richtige Adressat sind, teilen Sie dem Absender bitte den Erhalt der Mail mit und löschen Sie die Mail.<o:p></o:p></p>
<p>>> The content of this mail may contain confidential information and is intended solely for the designated addressee. If you are not the intended addressee, then please inform the sender about the receipt of this mail and delete the mail.<o:p></o:p></p>
<p>>> . <br>
>> -- <br>
>> Thomas Rudolph <br>
>> Teleconnect GmbH <br>
>> Am Lehmberg 54, 01157 Dresden, Germany <br>
>> <br>
>> Phone: +49 351 4236 214 (Main: - 210) <br>
>> E-Mail/Skype: rudt@teleconnect.de<<a href="mailto:rudt@teleconnect.de">mailto:rudt@teleconnect.de</a>>
<br>
>> <br>
>> <br>
>> Watch our current video! <br>
>> <<a href="https://www.youtube.com/watch?v=YtFrOo9rzSU">https://www.youtube.com/watch?v=YtFrOo9rzSU</a>>
<br>
>> <br>
>> Teleconnect <<a href="https://www.teleconnect.de">https://www.teleconnect.de</a>> Twitter <<a href="https://twitter.com/Teleconnect_">https://twitter.com/Teleconnect_</a>> Linkedin <<a href="https://www.linkedin.com/company/teleconnect-gmbh/">https://www.linkedin.com/company/teleconnect-gmbh/</a>><o:p></o:p></p>
<p>>> <br>
>> USt.-IdNr. (VAT ID): DE140301522 <br>
>> Registergericht (Commercial registry): Dresden, HRB 1040 <br>
>> Geschäftsführer (Managing Director): Dr. Gerald Nürnberger <br>
>> ________________________________ Der Inhalt dieser Mail enthält <br>
>> möglicherweise vertrauliche Informationen und ist ausschließlich für den bezeichneten Adressaten bestimmt. Wenn Sie nicht der richtige Adressat sind, teilen Sie dem Absender bitte den Erhalt der Mail mit und löschen Sie die Mail.<o:p></o:p></p>
<p>>> The content of this mail may contain confidential information and is intended solely for the designated addressee. If you are not the intended addressee, then please inform the sender about the receipt of this mail and delete the mail.<o:p></o:p></p>
<p>>> <br>
> . <br>
> -- <br>
> Thomas Rudolph <br>
> Teleconnect GmbH <br>
> Am Lehmberg 54, 01157 Dresden, Germany <br>
> <br>
> Phone: +49 351 4236 214 (Main: - 210) <br>
> E-Mail/Skype: rudt@teleconnect.de<<a href="mailto:rudt@teleconnect.de">mailto:rudt@teleconnect.de</a>>
<br>
> <br>
> <br>
> Watch our current video! <<a href="https://www.youtube.com/watch?v=YtFrOo9rzSU">https://www.youtube.com/watch?v=YtFrOo9rzSU</a>>
<br>
> <br>
> Teleconnect <<a href="https://www.teleconnect.de">https://www.teleconnect.de</a>> Twitter <<a href="https://twitter.com/Teleconnect_">https://twitter.com/Teleconnect_</a>> Linkedin <<a href="https://www.linkedin.com/company/teleconnect-gmbh/">https://www.linkedin.com/company/teleconnect-gmbh/</a>><o:p></o:p></p>
<p>> <br>
> USt.-IdNr. (VAT ID): DE140301522 <br>
> Registergericht (Commercial registry): Dresden, HRB 1040 <br>
> Geschäftsführer (Managing Director): Dr. Gerald Nürnberger <br>
> ________________________________ <br>
> Der Inhalt dieser Mail enthält möglicherweise vertrauliche Informationen und ist ausschließlich für den bezeichneten Adressaten bestimmt. Wenn Sie nicht der richtige Adressat sind, teilen Sie dem Absender bitte den Erhalt der Mail mit und löschen Sie die
Mail.<o:p></o:p></p>
<p>> The content of this mail may contain confidential information and is intended solely for the designated addressee. If you are not the intended addressee, then please inform the sender about the receipt of this mail and delete the mail.<o:p></o:p></p>
<p>> <o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
</div>
. <span style="font-size: 10pt; font-family: Arial, serif, EmojiFont;">-- <br>
Thomas Rudolph<br>
Teleconnect GmbH <br>
</span><span style="font-size: 8pt; font-family: Arial, serif, EmojiFont;">Am Lehmberg 54, 01157 Dresden, Germany<br>
<br>
</span>
<table style="font-size: 10pt; font-family: Arial, serif, EmojiFont;" border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td>Phone:</td>
<td width="15"></td>
<td>+49 351 4236 214 (Main: - 210)</td>
</tr>
<tr>
<td>E-Mail/Skype: </td>
<td></td>
<td><a href="mailto:rudt@teleconnect.de">rudt@teleconnect.de</a></td>
</tr>
</tbody>
</table>
<br>
<br>
<a href="https://www.youtube.com/watch?v=YtFrOo9rzSU" target="_blank" rel="noopener" style="font-size: 10pt; font-family: Arial, serif, EmojiFont; background-color: #5aa035; border: none; color: white; padding: 5px 15px; text-align: center; text-decoration: none; display: inline-block; margin: 4px 2px; cursor: pointer;"> Watch
our current video! </a> <br>
<br>
<a href="https://www.teleconnect.de" target="_blank" rel="noopener" style="font-size: 10pt; font-family: Arial, serif, EmojiFont; background-color: #C81714; border: none; color: white; padding: 5px 15px; text-align: center; text-decoration: none; display: inline-block; margin: 4px 2px; cursor: pointer;"> Teleconnect </a>
<a href="https://twitter.com/Teleconnect_" target="_blank" rel="noopener" style="font-size: 10pt; font-family: Arial, serif, EmojiFont; background-color: #0097D3; border: none; color: white; padding: 5px 15px; text-align: center; text-decoration: none; display: inline-block; margin: 4px 2px; cursor: pointer;">
Twitter </a> <a href="https://www.linkedin.com/company/teleconnect-gmbh/" target="_blank" rel="noopener" style="font-size: 10pt; font-family: Arial, serif, EmojiFont; background-color: #00ABF1; border: none; color: white; padding: 5px 15px; text-align: center; text-decoration: none; display: inline-block; margin: 4px 2px; cursor: pointer;">
Linkedin </a> <br>
<span style="font-size: 8pt; font-family: Arial, serif, EmojiFont;"><br>
USt.-IdNr. (VAT ID): DE140301522<br>
Registergericht (Commercial registry): Dresden, HRB 1040<br>
Geschäftsführer (Managing Director): Dr. Gerald Nürnberger<br>
</span>
<hr>
<span style="font-size: 8pt; font-family: Arial, serif, EmojiFont;color: #999999;">Der Inhalt dieser Mail enthält möglicherweise vertrauliche Informationen und ist ausschließlich für den bezeichneten Adressaten bestimmt. Wenn Sie nicht der richtige Adressat
sind, teilen Sie dem Absender bitte den Erhalt der Mail mit und löschen Sie die Mail.<br>
The content of this mail may contain confidential information and is intended solely for the designated addressee. If you are not the intended addressee, then please inform the sender about the receipt of this mail and delete the mail.</span>
</body>
</html>