Bug 1335896

Summary:	ipsec initnss/checknss custom directory not recognized
Product:	Red Hat Enterprise Linux 6	Reporter:	Jaroslav Aster <jaster>
Component:	libreswan	Assignee:	Paul Wouters <pwouters>
Status:	CLOSED ERRATA	QA Contact:	Jaroslav Aster <jaster>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.8	CC:	omoris
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libreswan-3.15-7.el6.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1290907	Environment:
Last Closed:	2017-03-21 09:06:13 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1290907
Bug Blocks:

Description Jaroslav Aster 2016-05-13 13:36:49 UTC

The same issue on rhel-6.

libreswan-3.15-5.3.el6

See original bug for more information.

+++ This bug was initially created as a clone of Bug #1290907 +++

Copied from u/s: https://github.com/libreswan/libreswan/issues/44

"I set up Openstack with VPNaaS.

During creation process of the VPN this command is executed:
ip netns exec qrouter-664940e8-6139-4c36-8fcc-ee9e06bd5212 ipsec checknss /var/lib/neutron/ipsec/664940e8-6139-4c36-8fcc-ee9e06bd5212/etc

The db files are always added to the directory /etc/ipsec.d
Looking at the bash script "ipsec" i saw that the variable IPSEC_NSSDIR_SQL is set only at the beginning of the script.
If a custom directory is specified, the variable IPSEC_NSSDIR_SQL is not changed.

Adding IPSEC_NSSDIR_SQL="sql:${IPSEC_NSSDIR}" resolved the issue."

We are experiencing this issue in our neutron CI system. Our current version of libreswan is 3.15. 

The patch has been already been merged u/s in: 

https://github.com/libreswan/libreswan/commit/709e2a92d768afc6c78e5a243f0076ddec744c8a

Comment 6 errata-xmlrpc 2017-03-21 09:06:13 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2017-0575.html