Bug 1313747

Summary: ipsec pluto returns zero even if it fails
Product: Red Hat Enterprise Linux 7 Reporter: Jaroslav Aster <jaster>
Component: libreswanAssignee: Paul Wouters <pwouters>
Status: CLOSED ERRATA QA Contact: Jaroslav Aster <jaster>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.3CC: omoris
Target Milestone: rcKeywords: Documentation
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Cause: pluto daemon did not always return proper error code on failure to start Consequence: a process starting pluto would not realise if something had gone wrong Fix: return proper error code Result: calling processes now know when pluto failed to start and can take appropriate action
 Story Points: ---
Clone Of: 1313709 Environment:
Last Closed: 2016-11-03 21:22:56 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jaroslav Aster 2016-03-02 09:58:16 UTC 
The same behaviour on rhel-7.

libreswan-3.15-5.el7_1

+++ This bug was initially created as a clone of Bug #1313709 +++

Description of problem:

ipsec pluto command returns zero even if it fails and prints nothing to the output.

Version-Release number of selected component (if applicable):

libreswan-3.15-5.1.el6

How reproducible:

100%

Steps to Reproduce:

1. Install libreswan package and make sure, there is no db files in /etc.ipsec.d. It is true for fresh installation of libreswan, before service ipsec start command is run.

2. Run ipsec pluto command.

# yum install -y libreswan
...

# ls /etc/ipsec.d/
policies  v6neighbor-hole.conf

# ipsec pluto

# echo $?
0

# ps -fA|grep pluto
root     20056 17761  0 04:34 pts/0    00:00:00 grep pluto

# grep pluto /var/log/secure
Mar  2 04:33:38 unused-4-151 pluto[20028]: NSS DB directory: sql:/etc/ipsec.d
Mar  2 04:33:38 unused-4-151 pluto[20028]: NSS readonly initialization ("sql:/etc/ipsec.d") failed (err -8174) 
Mar  2 04:33:38 unused-4-151 pluto[20028]: FATAL: NSS initialization failure

Actual results:

ipsec returns zero and prints nothing to the output.

Expected results:

ipsec returns non-zero and prints something useful to the output.

Additional info:

--- Additional comment from Jaroslav Aster on 2016-03-02 04:53:53 EST ---

It seems that openswan has a different behaviour than libreswan.

# rpm -q openswan
openswan-2.6.32-37.el6.x86_64

# killall pluto

# ps -fA|grep pluto
root     20479 20206  0 04:48 pts/0    00:00:00 grep pluto

# rm -f /etc/ipsec.d/*.db

# ls /etc/ipsec.d/
policies

# ipsec pluto

# echo $?
0

# ls /etc/ipsec.d/
cert8.db  key3.db  policies  secmod.db

# ps -fA|grep pluto
root     20501     1  0 04:48 ?        00:00:00 /usr/libexec/ipsec/pluto
root     20504 20501  0 04:48 ?        00:00:00 _pluto_adns
root     20507 20206  0 04:48 pts/0    00:00:00 grep pluto
Comment 1 Jaroslav Aster 2016-04-28 16:03:21 UTC 
See https://bugzilla.redhat.com/show_bug.cgi?id=1313709#c5.
Comment 5 errata-xmlrpc 2016-11-03 21:22:56 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2603.html