<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi,<div><br></div><div>The issue is with systemd service apparently, I started with init.d/ipsec and is ok.</div><div><div><div><br></div><div>The generated package for version 4.9 doesn’t include a unit file. </div><div><br>dpkg -c binaries/libreswan_4.9-1_amd64.deb | grep systemd<br>drwxr-xr-x root/root 0 2022-10-13 01:00 ./lib/systemd/<br>drwxr-xr-x root/root 0 2022-10-13 01:00 ./lib/systemd/system-preset/<br>-rw-r--r-- root/root 145 2022-10-13 01:00 ./lib/systemd/system-preset/90-libreswan.preset</div><div><br></div><div><div><div>But package 4.7 it was present:</div><div>dpkg -c libreswan_4.7-1_amd64.deb | grep systemd<br>drwxr-xr-x root/root 0 2022-05-24 01:00 ./lib/systemd/<br>drwxr-xr-x root/root 0 2022-05-24 01:00 ./lib/systemd/system/<br>-rw-r--r-- root/root 1531 2022-05-24 01:00 ./lib/systemd/system/ipsec.service<br>drwxr-xr-x root/root 0 2022-05-24 01:00 ./lib/systemd/system-preset/<br>-rw-r--r-- root/root 145 2022-05-24 01:00 ./lib/systemd/system-preset/90-libreswan.preset<br></div></div><div><br></div><br>It was removed in commit: https://github.com/libreswan/libreswan/commit/20fe3adb398eaafb8dc62df06cf32461aaa817d7<br><br></div></div></div><div>On my server i had copy ipsec.service into /etc/systemd/system/ipsec.service, and when updated to 4.9 it wasn’t removed. </div><div><br></div><div>The unit file i had is the same as in version 4.7:</div><div><br></div><div><p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">[Unit]</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">Description=Internet Key Exchange (IKE) Protocol Daemon for IPsec</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">Wants=network-online.target</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">After=network-online.target</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">Documentation=man:ipsec(8) man:pluto(8) man:ipsec.conf(5)</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0); min-height: 14px;"><span style="font-variant-ligatures: no-common-ligatures"></span><br></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">[Service]</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">Type=notify</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">Restart=on-failure</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># 12 is the shutdown while leaving kernel state. Restarting would still kill kernel state</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">RestartPreventExitStatus=12</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0); min-height: 14px;"><span style="font-variant-ligatures: no-common-ligatures"></span><br></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">#RestartPreventExitStatus=137 143 SIGTERM SIGKILL</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0); min-height: 14px;"><span style="font-variant-ligatures: no-common-ligatures"></span><br></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># Set WatchdogSec to the amount of time (in seconds) that systemd will wait</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># before restarting an unresponsive pluto.</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># EVENT_SD_WATCHDOG updates the heartbeat every 15 seconds, recommended values</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># are 60, 90, 120. WatchdogSec=0 disables the action</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">NotifyAccess=all</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">WatchdogSec=200</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0); min-height: 14px;"><span style="font-variant-ligatures: no-common-ligatures"></span><br></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># Check configuration file</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">ExecStartPre=/usr/libexec/ipsec/addconn --config /etc/ipsec.conf --checkconfig</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># Check for kernel modules</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">ExecStartPre=/usr/libexec/ipsec/_stackmanager start</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># Check for nss database status and migration</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">ExecStartPre=/usr/sbin/ipsec --checknss</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># Check for nflog setup</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">ExecStartPre=/usr/sbin/ipsec --checknflog</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># Start the actual IKE daemon</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">ExecStart=/usr/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># Enable for portexcludes support</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># ExecStartPost=/usr/libexec/ipsec/portexcludes</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">ExecStop=/usr/libexec/ipsec/whack --shutdown</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures"># 12 is the exit code of pluto for shutting down "leaving state"</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">ExecStopPost=/bin/bash -c 'if test "$EXIT_STATUS" != "12"; then /sbin/ip xfrm policy flush; /sbin/ip xfrm state flush; fi'</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">ExecStopPost=/usr/sbin/ipsec --stopnflog</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0); min-height: 14px;"><span style="font-variant-ligatures: no-common-ligatures"></span><br></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">[Install]</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgb(0, 0, 0);"><span style="font-variant-ligatures: no-common-ligatures">WantedBy=multi-user.target</span></p></div><div><div><br></div><div><br></div><div><br></div><div>I manage to make it work with systemd by changing the service type to: Type=simple, instead of Type=notify, Pluto is not sending the notification message when starting. </div><div><br></div><div><br></div><div><span><div>—<br>Saludos / Regards / Cumprimentos<br>António Silva<br>
</div>
<br><blockquote type="cite">On 21 Oct 2022, at 10:41, antonio <asilva@wirelessmundi.com> wrote:<br><br class="Apple-interchange-newline">Hi,<br><br>I update from libreswan 4.7 to 4.9 the connection is establish OK, but the ipsec service is restarting continuously.. and that restart the connection. <br><br>The restart is provoked by systemd, because the service is not starting normally, it gives timeout and that triggers the restart. <br><br>I later remove the connection definition from the configuration and try to start ipsec and I got the same error, timeout. <br>Reverting to version 4.7 everything is ok.<br><br><br>I can’t see where is the timeout. <br><br>[10:36:15][beelink][~]# systemctl start ipsec<br>Job for ipsec.service failed because a timeout was exceeded.<br>See "systemctl status ipsec.service" and "journalctl -xe" for details.<br><br><br>Small log before timed out:<br><br>Oct 21 10:37:37 beelink pluto[21609]: | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations<br>Oct 21 10:37:37 beelink pluto[21609]: | spent 0.132 (0.133) milliseconds in in connection_check_ddns for hostname lookup<br>Oct 21 10:37:37 beelink pluto[21609]: | spent 0.191 (0.189) milliseconds in global timer EVENT_PENDING_DDNS<br>Oct 21 10:37:37 beelink pluto[21609]: | processing global timer EVENT_SHUNT_SCAN<br>Oct 21 10:37:37 beelink pluto[21609]: | kernel: checking for aged bare shunts from shunt table to expire<br>Oct 21 10:37:37 beelink pluto[21609]: | spent 0.0442 (0.0416) milliseconds in global timer EVENT_SHUNT_SCAN<br>Oct 21 10:37:57 beelink pluto[21609]: | processing global timer EVENT_SHUNT_SCAN<br>Oct 21 10:37:57 beelink pluto[21609]: | kernel: checking for aged bare shunts from shunt table to expire<br>Oct 21 10:37:57 beelink pluto[21609]: | spent 0.0614 (0.049) milliseconds in global timer EVENT_SHUNT_SCAN<br>Oct 21 10:38:07 beelink systemd[1]: ipsec.service: Start operation timed out. Terminating.<br><br><br>Full log here: https://pastebin.com/qJ7DY9QU <br>Thanks. <br><br>—<br>Saludos / Regards / Cumprimentos<br>António Silva<br>
<br>_______________________________________________<br>Swan mailing list<br>Swan@lists.libreswan.org<br>https://lists.libreswan.org/mailman/listinfo/swan<br></blockquote><br></span><div></div><div></div></div></div></body></html>