[strongSwan] Multiple charon daemons mininet namespaces

Piyush Agarwal agarwalpiyush at gmail.com
Thu Apr 27 02:27:39 CEST 2017


Yes I did. Did not help, got same issue.

I guess I'll go the way of modifying configure and generating a private
.deb file (that sets piddir to be /etc/ipsec.d/run).

However, when I download deb-src and _WITHOUT_ any change of mine, just
rebuild it, I seem to have a test failure:

  Running suite 'settings':
    Running case 'get/set_str (basic behavior)': +++++
    Running case 'get/set_bool': ++
    Running case 'get/set_int': ++
    Running case 'get/set_double': ++
    Running case 'get/set_time': ++
    Running case 'section enumerator': +
    Running case 'key/value enumerator': +
    Running case 'include/load_files[_section]': ++-
*      Failure in 'test_load_files_section':
!settings->load_files_section(settings, include1".no", TRUE, "")
(suites/test_settings.c:650, i = 0)*


I even tried disabling running tests by using the following command:
sudo DEB_BUILD_OPTIONS=nocheck debuild -us -uc -b

Does anyone know either (i) How to disable tests or (ii) What the test
failure is without any code change whatsoever?

Thank you.
Piyush



On Wed, Apr 26, 2017 at 5:18 PM, Noel Kuntze <
noel.kuntze+strongswan-users-ml at thermi.consulting> wrote:

> Hello Piyush,
>
> Did you try copying the files, instead of symlinking?
>
> On 27.04.2017 01:04, Piyush Agarwal wrote:
> > Hi Noel,
> > Many thanks for the pointer. Your second suggestion might not work
> though: in addition to changing daemon name, ipsec_starter also looks for
> an actual daemon with that name which it won't find unless it is indeed
> "charon" always.
> >
> > My two namespaces here are "gateway" and "relay".
> >
> > a at strongswan3:~/strongswan$ sudo ip netns exec gateway
> /usr/lib/ipsec/starter --daemon charon_gateway
> > Starting strongSwan 5.1.2 IPsec [starter]...
> > Disabling charon_gatewaystart option, '/usr/lib/ipsec/charon_gateway'
> not found
> >
> > I then tried to symlink such that /usr/lib/ipsec/charon_gateway and
> /usr/lib/ipsec/charon_relay are available (and pointing to
> /usr/lib/ipsec/charon). But that leads to more mess with the daemon getting
> continuously restarted.
> >
> > a at strongswan3:~/strongswan$ ps aux | grep ipsec
> > root      6114  0.1  0.0  15160  1456 ?        Ss   22:58   0:00
> /usr/lib/ipsec/starter --daemon charon_relay
> > root      6253  0.0  0.0 552128  7228 ?        Ssl  22:59   0:00
> /usr/lib/ipsec/charon_relay --use-syslog
> >
> > a at strongswan3:~/strongswan$ ps aux | grep ipsec
> > root      6114  0.1  0.0  15160  1456 ?        Ss   22:58   0:00
> /usr/lib/ipsec/starter --daemon charon_relay
> > root      6535  0.0  0.0 552128  5044 ?        Ssl  23:03   0:00
> /usr/lib/ipsec/charon_relay --use-syslog
> >
> > Sigh.
> >
> >
> > On Wed, Apr 26, 2017 at 3:27 PM, Noel Kuntze
> <noel.kuntze+strongswan-users-ml at thermi.consulting <mailto:noel.kuntze+
> strongswan-users-ml at thermi.consulting>> wrote:
> >
> >     I just took a look at it and it seems you can change the file's name
> by setting the --daemon[1]
> >     parameter of ipsec starter.
> >
> >     [1] https://github.com/strongswan/strongswan/blob/master/src/
> starter/starter.c#L291 <https://github.com/strongswan/strongswan/blob/
> master/src/starter/starter.c#L291>
> >
> >     On 27.04.2017 00 <tel:27.04.2017%2000>:25, Noel Kuntze wrote:
> >     > Hello Piyush,
> >     >
> >     > The path to the PID file is hard coded during build time.
> >     > Take a look at the source code of starter[1] and track the
> >     > variable assignments down.
> >     >
> >     > [1] https://github.com/strongswan/strongswan/tree/master/src/
> starter <https://github.com/strongswan/strongswan/tree/master/src/starter>
> >     >
> >     > Kind regards,
> >     > Noel
> >     >
> >     > On 27.04.2017 00 <tel:27.04.2017%2000>:14, Piyush Agarwal wrote:
> >     >> Hi Noel,
> >     >> Thanks for your reply but I am not sure I completely understood
> your answer.
> >     >>
> >     >> While waiting for a reply to my question, I tried this though:
> >     >>
> >     >> 1) Downloaded strongswan-starter deb file. Unpacked it.
> >     >> 2) Changed IPSEC_PIDDIR in usr/sbin/ipsec file to point to
> /etc/ipsec.d/run (rather than /var/run)
> >     >> 3) Re-built the deb file
> >     >> 4) Installed this new deb file on my ubuntu 14.04 host
> >     >> 5) Now ipsec binary does report piddir to be the changed location:
> >     >>
> >     >> a at strongswan3:~$ sudo ip netns exec blue ipsec --piddir
> >     >> /etc/ipsec.d/run
> >     >>
> >     >> But charon seems to still think the piddir is /var/run and hence
> wouldn't start the second instance.
> >     >>
> >     >> a at strongswan3:~$ sudo ip netns exec red ipsec start
> >     >> Starting strongSwan 5.1.2 IPsec [starter]...
> >     >> charon is already running (/var/run/charon.pid exists) --
> skipping daemon start
> >     >> starter is already running (/var/run/starter.charon.pid exists)
> -- no fork done
> >     >>
> >     >> So obviously charon is getting its piddir from somewhere else. I
> am looking for source code to modify such that charon's piddir is not
> hardcoded to /var/run (as it currently seems to be). I'd like to make it
> modifiable via either a command line, conf file or some other similar way.
> Perhaps I may be okay to even hardcode it in my private .deb file to be
> /etc/ipsec.d/run rather than /var/run.
> >     >>
> >     >> Is there any pointer to achieving this? Requiring install from
> source code and modifying ./configure options to change piddir is just a
> no-go for me unfortunately.
> >     >>
> >     >> Thank you.
> >     >> Piyush
> >     >>
> >     >> On Wed, Apr 26, 2017 at 11:23 AM, Noel Kuntze
> <noel.kuntze at thermi.consulting <mailto:noel.kuntze at thermi.consulting
> <mailto:noel.kuntze at thermi.consulting>>> wrote:
> >     >>
> >     >>     You can't do that when you start charon using "ipsec" (which
> implicitely calls "ipsec starter".
> >     >>     You can do it with charon-systemd, though (but then you need
> to start it using systemd and you get a similiar problem).
> >     >>
> >     >>     On 26.04.2017 20 <tel:26.04.2017%2020>
> <tel:26.04.2017%2020>:11, Piyush Agarwal wrote:
> >     >>     > Hi,
> >     >>     > I need to run multiple ipsec charon daemons in multiple
> mininet namespaces (perhaps some semantics change from ip namespaces).
> >     >>     >
> >     >>     > Sure enough, on following steps from
> https://wiki.strongswan.org/projects/strongswan/wiki/Netns <
> https://wiki.strongswan.org/projects/strongswan/wiki/Netns> <
> https://wiki.strongswan.org/projects/strongswan/wiki/Netns <
> https://wiki.strongswan.org/projects/strongswan/wiki/Netns>> (including
> piddir change), I could get multiple charon daemons running with*ip network
> namespaces*.
> >     >>     >
> >     >>     > I am not trying to achieve two things:
> >     >>     > 1) Run multiple charon daemons with mininet namespaces
> >     >>     > 2) Be able to do so without requiring piddir configuration
> option change.
> >     >>     >
> >     >>     > Regarding (1): I am not sure if mininet namespaces provide
> for bind mounting anything /etc/netns/<namespace name>/ to /etc/ for the
> process running in that network namespace -- if it doesn't, I will bind
> mount manually before starting charon/ipsec. So this should be okay.
> >     >>     >
> >     >>     > But, I am trying to find how I can do away the piddir
> configuration change and make it work directly from the deb file install.
> Is there no way to achieve this? No environment variable that can be set?
> >     >>     >
> >     >>     > Appreciate any comments/directions/pointers.
> >     >>     >
> >     >>     > Thank you.
> >     >>     > Piyush
> >     >>     >
> >     >>     >
> >     >>     > --
> >     >>     > Piyush Agarwal
> >     >>     > Life can only be understood backwards; but it must be lived
> forwards.
> >     >>     >
> >     >>     >
> >     >>     > _______________________________________________
> >     >>     > Users mailing list
> >     >>     > Users at lists.strongswan.org <mailto:Users at lists.
> strongswan.org> <mailto:Users at lists.strongswan.org <mailto:Users at lists.
> strongswan.org>>
> >     >>     > https://lists.strongswan.org/mailman/listinfo/users <
> https://lists.strongswan.org/mailman/listinfo/users> <
> https://lists.strongswan.org/mailman/listinfo/users <
> https://lists.strongswan.org/mailman/listinfo/users>>
> >     >>
> >     >>     --
> >     >>     Noel Kuntze
> >     >>     IT security consultant
> >     >>
> >     >>     GPG Key ID: 0x0739AD6C
> >     >>     Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C
> >     >>
> >     >>
> >     >>
> >     >>
> >     >>
> >     >> --
> >     >> Piyush Agarwal
> >     >> Life can only be understood backwards; but it must be lived
> forwards.
> >     >>
> >     >>
> >     >> _______________________________________________
> >     >> Users mailing list
> >     >> Users at lists.strongswan.org <mailto:Users at lists.strongswan.org>
> >     >> https://lists.strongswan.org/mailman/listinfo/users <
> https://lists.strongswan.org/mailman/listinfo/users>
> >     >
> >     >
> >     >
> >     > _______________________________________________
> >     > Users mailing list
> >     > Users at lists.strongswan.org <mailto:Users at lists.strongswan.org>
> >     > https://lists.strongswan.org/mailman/listinfo/users <
> https://lists.strongswan.org/mailman/listinfo/users>
> >     >
> >
> >
> >
> >
> > --
> > Piyush Agarwal
> > Life can only be understood backwards; but it must be lived forwards.
>
>
>


-- 
Piyush Agarwal
Life can only be understood backwards; but it must be lived forwards.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20170426/88823cdc/attachment-0001.html>


More information about the Users mailing list