Bug 2018547

Description of the problem:

Centos 8.4.2105
Linux strongSwan U5.9.4/K4.18.0-305.19.1.el8_4.x86_64

Strongswan command 'strongswan restart' breaks ipsec when strongswan-starter is used to start ipsec with systemctl. It actually happened today when strongswan was upgraded. Strongswan was restarted after package upgrade and it broke ipsec because ipsec was started with strongswan-starter systemd unit. Quick investigation showed that the reason was missing /run/strongswan/ directory after issuing 'strongswan restart' command.

Steps to reproduce:

1. systemctl start strongswan-starter.service

check runtime directory:
ll /run/strongswan/
total 8
srwxrwx--- 1 root root 0 Oct 29 19:14 charon.ctl
srwxrwx--- 1 root root 0 Oct 29 19:14 charon.dck
-rw-r--r-- 1 root root 5 Oct 29 19:14 charon.pid
srwxrwx--- 1 root root 0 Oct 29 19:14 charon.vici
-rw-r--r-- 1 root root 5 Oct 29 19:14 starter.charon.pid

strongswan status shows successful connections

2. strongswan restart
Stopping strongSwan IPsec...
Starting strongSwan 5.9.4 IPsec [starter]...

ll /run/strongswan/
ls: cannot access '/run/strongswan/': No such file or directory

strongswan status shows no connections

In the logs:
00[DMN] unable to create pidfile '/run/strongswan/charon.pid'

strongswan[1542]: charon stopped after 200 ms
strongswan[1542]: ipsec starter stopped
ipsec_starter[1542]: charon stopped after 200 ms
ipsec_starter[1542]: ipsec starter stopped
systemd[1]: strongswan-starter.service: Succeeded.
ipsec_starter[1589]: Starting strongSwan 5.9.4 IPsec [starter]...
ipsec_starter[1603]: charon has quit: initialization failed
ipsec_starter[1603]: charon refused to be started
ipsec_starter[1603]: ipsec starter stopped

Additional Info:

It looks like 'strongswan restart' terminates the starter process and runtime dir is deleted. Afterwards strongswan cli commands do not work because the directory does not exist. So it looks like strongswan cli commands cannot be used together with systemd strongswan-starter.service. It can cause service interruptions with automatic or manual upgrades when strongswan-starter.service is used to bring up ipsec.