Bug 1345959 - openswan - libreswan migration issues
Summary: openswan - libreswan migration issues
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libreswan
Version: 6.8
Hardware: All
OS: Linux
high
medium
Target Milestone: rc
: ---
Assignee: Paul Wouters
QA Contact: Ondrej Moriš
URL:
Whiteboard:
Depends On:
Blocks: 1269194 1343211
TreeView+ depends on / blocked
 
Reported: 2016-06-13 13:50 UTC by Ondrej Moriš
Modified: 2018-01-21 13:45 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-03-21 09:06:16 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 2381091 0 None None None 2016-06-16 20:09:40 UTC
Red Hat Product Errata RHBA-2017:0575 0 normal SHIPPED_LIVE libreswan bug fix update 2017-03-21 12:23:23 UTC

Description Ondrej Moriš 2016-06-13 13:50:28 UTC
Description of problem:

Two issues related to recent openswan -> libreswan migration have been identified by Paul.

1) Status of ipsec service is not preserved when updating from openswan to libreswan.

2) Previously, ike option allowed to use so-called strict mode when IKE algorithm started with "!", this was already obsoleted in openswan and ignored. With libreswan this notation is no longer recognized (syntax error). 

Version-Release number of selected component (if applicable):

libreswan-3.15-5.3.el6

How reproducible:

100%

Steps to Reproduce:

1.1 Make sure openswan is installed, ipsec service enabled and started.
1.2 Upgrade to libreswan.
1.3 Check if ipsec service state is preserved (enable & started).

2.1 Create a configuration with ike=!<something> and auto=add connection.
2.2 Start ipsec service.
2.3 Check that the connection is loaded into SPD correctly.

Actual results:

1. ipsec service state is not preserved.
2. connection is not loaded.

Expected results:

1. ipsec service state is preserved.
2. connection is loaded.

Additional info:

Paul already proposed solution, both issues can be solved in initscript.

Comment 7 Ondrej Moriš 2016-12-19 22:26:48 UTC
(In reply to Ondrej Moriš from comment #0)

> 1) Status of ipsec service is not preserved when updating from openswan to
> libreswan.

This is fixed now. Both default state and status are preserved now. However, when ipsec is restarted during upgrade to libreswan it prints the following message:

Shutting down pluto IKE daemon
030 ignoring message from whack with bad magic 2003331865; should be 1869114150; Mismatched versions of userland tools and KLIPS code.
 
> 2) Previously, ike option allowed to use so-called strict mode when IKE
> algorithm started with "!", this was already obsoleted in openswan and
> ignored. With libreswan this notation is no longer recognized (syntax
> error). 

This seems not to be fixed - having ike=!<something> will produce the following error:

Dec 19 17:22:09: ike string error: No alphanum. char initially found, just after "" (old_state=ST_INI)

Comment 8 Ondrej Moriš 2016-12-20 21:21:21 UTC
(In reply to Ondrej Moriš from comment #7)
 
> > 2) Previously, ike option allowed to use so-called strict mode when IKE
> > algorithm started with "!", this was already obsoleted in openswan and
> > ignored. With libreswan this notation is no longer recognized (syntax
> > error). 
> 
> This seems not to be fixed - having ike=!<something> will produce the
> following error:
> 
> Dec 19 17:22:09: ike string error: No alphanum. char initially found, just
> after "" (old_state=ST_INI)

I am not sure what was the decision about ike=!<something>. Could you shed some light on it Paul? Behaviour of libreswan is the same in 6.8 and 6.9 - syntax error. In openswan as far as I am trying to recall "!" character was ignored and connection was loaded. I see the following options:

 1) libreswan ignores "!" and load the connection
 2) libreswan fails to load connection and reports that using "!" is no longer
    supported
 3) "!" characters are removed during openswan->libreswan update

From my point of view the second option would be the best.

Comment 9 Paul Wouters 2016-12-21 04:37:17 UTC
upstream libreswan has never supported ignoring the "!". That change from openswan was part of the first libreswan release (3.0)

It was already years obsolete in openswan.

Currently, option 2 happens. I do not think we need to make any change to libreswan so support that very old syntax. No one should have been using it with openswan either because even for openswan when specifying an ike=/esp= line, it would be automatically "strict".

Comment 10 Ondrej Moriš 2016-12-21 10:32:29 UTC
Thanks Paul. Even though I imagined something more helpful than "ike string error: No alphanum. char initially found, just after """, I can see your point

 a) this problem will affect literally nobody,
 b) the rest will find parser error message in the log leading them to ike string,
 c) changing the parser to handle this particular error would be really odd.

All in all, I consider this bug to be successfully verified now, for more details please see TJ#1642906.

Comment 12 errata-xmlrpc 2017-03-21 09:06:16 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2017-0575.html


Note You need to log in before you can comment on or make changes to this bug.