RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1313816 - pluto crashes with --ctlbase option
Summary: pluto crashes with --ctlbase option
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libreswan
Version: 6.9
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Paul Wouters
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-03-02 12:04 UTC by Jaroslav Aster
Modified: 2017-09-06 03:32 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1313821 (view as bug list)
Environment:
Last Closed: 2017-09-06 03:32:22 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
Abrt logs. (1.76 MB, application/x-gzip)
2016-03-02 12:04 UTC, Jaroslav Aster 		no flags Details
View All

Description Jaroslav Aster 2016-03-02 12:04:22 UTC 
Created attachment 1132281 [details]
Abrt logs.

Description of problem:

Pluto crashes with --ctlbase option. It appears only on x86_64.

Version-Release number of selected component (if applicable):


How reproducible:

mostly, but not 100%

Steps to Reproduce:

# yum install -y libreswan

# rm -rf /etc/ipsec.d/*.db /etc/ipsec.d/pkcs11.txt

# mkdir /tmp/pluto

# ipsec initnss
Initializing NSS database
See 'man pluto' if you want to protect the NSS database with a password

# ipsec pluto --ctlbase /tmp/pluto

# dmesg | grep pluto | grep segfault
pluto[11944]: segfault at 0 ip 00007f79c6069d36 sp 00007fff2379fdf0 error 4 in pluto[7f79c6002000+10a000]

Actual results:

Pluto crashes.

Expected results:

Pluto does not crash.

Additional info:
Comment 1 Jaroslav Aster 2016-03-02 12:08:27 UTC 
Version libreswan-3.15-5.1.el6.x86_64.
Comment 2 Paul Wouters 2016-03-04 21:57:24 UTC 
I think you are crashing based on no kernel stack being loaded (and sometimes it got loaded for you). Since you are not running ipsec _stackmanager that handles that before pluto starts.

I confirmed on 3.15:

(gdb) bt
#0  0x00007ffff7f5ce46 in init_kernel () at /usr/src/debug/libreswan-3.15/programs/pluto/kernel.c:2420
#1  0x00007ffff7f2a18f in main (argc=<value optimized out>, argv=<value optimized out>)
    at /usr/src/debug/libreswan-3.15/programs/pluto/plutomain.c:1581
(gdb) f 0
#0  0x00007ffff7f5ce46 in init_kernel () at /usr/src/debug/libreswan-3.15/programs/pluto/kernel.c:2420
2420		ev_fd = pluto_event_new(*kernel_ops->async_fdp, EV_READ | EV_PERSIST,
(gdb) p kernel_ops
$1 = (const struct kernel_ops *) 0x7ffff8200740


I tried to reproduce it with no kernel stack on 3.16, which nicely terminates telling you no kernel stack was found. So this will get fixed in the next rebase.

It is a minor bug, because nornal ike daemon start ensures the kernel stack is loaded.

if you are using this kind of starting for testing, before starting pluto add: ipsec _stackmanager start
Comment 3 Paul Wouters 2016-03-04 21:59:36 UTC 
also, if you want to run with the nss db in /tmp/pluto, you need to run ipsec initnss --ctlbase /tmp/pluto
Comment 4 Paul Wouters 2016-08-24 02:24:08 UTC 
We will pull this in if/when we upgrade to 3.16 or higher. Since triggering this requires two errors (not using proper initsystem and not using a proper initialed nss)
Comment 6 Paul Wouters 2017-09-06 03:32:22 UTC 
This bug is fixed in rhel7. This bug does not qualify for a fix in rhel6
Note You need to log in before you can comment on or make changes to this bug.