Bug 1335896 - ipsec initnss/checknss custom directory not recognized
Summary: ipsec initnss/checknss custom directory not recognized
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libreswan
Version: 6.8
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Paul Wouters
QA Contact: Jaroslav Aster
Depends On: 1290907
TreeView+ depends on / blocked
Reported: 2016-05-13 13:36 UTC by Jaroslav Aster
Modified: 2017-03-21 09:06 UTC (History)
1 user (show)

Fixed In Version: libreswan-3.15-7.el6.1
Doc Type: Bug Fix
Doc Text:
Clone Of: 1290907
Last Closed: 2017-03-21 09:06:13 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0575 0 normal SHIPPED_LIVE libreswan bug fix update 2017-03-21 12:23:23 UTC

Description Jaroslav Aster 2016-05-13 13:36:49 UTC
The same issue on rhel-6.


See original bug for more information.

+++ This bug was initially created as a clone of Bug #1290907 +++

Copied from u/s: https://github.com/libreswan/libreswan/issues/44

"I set up Openstack with VPNaaS.

During creation process of the VPN this command is executed:
ip netns exec qrouter-664940e8-6139-4c36-8fcc-ee9e06bd5212 ipsec checknss /var/lib/neutron/ipsec/664940e8-6139-4c36-8fcc-ee9e06bd5212/etc

The db files are always added to the directory /etc/ipsec.d
Looking at the bash script "ipsec" i saw that the variable IPSEC_NSSDIR_SQL is set only at the beginning of the script.
If a custom directory is specified, the variable IPSEC_NSSDIR_SQL is not changed.

Adding IPSEC_NSSDIR_SQL="sql:${IPSEC_NSSDIR}" resolved the issue."

We are experiencing this issue in our neutron CI system. Our current version of libreswan is 3.15. 

The patch has been already been merged u/s in: 


Comment 6 errata-xmlrpc 2017-03-21 09:06:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.