Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nixos/libreswan: use /etc/ipsec.conf as config #48029

Closed
wants to merge 1 commit into from
Closed

nixos/libreswan: use /etc/ipsec.conf as config #48029

wants to merge 1 commit into from

Conversation

ooesili
Copy link
Contributor

@ooesili ooesili commented Oct 8, 2018 •
edited

Motivation for this change

It appears that the --config flags don't actually work, because
libreswan fails to start unless the config exists at /etc/ipsec.conf as
well. The simplest solution is just to exclusively use /etc/ipsec.conf
as a config file which seems to make libreswan happy.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Fits CONTRIBUTING.md.

@ooesili
Copy link
Contributor Author

ooesili commented Oct 8, 2018

Hmmm. Changes to the config file no longer trigger restarts of the ipsec service because there is no longer a store path that changes. Not really sure how to get around this.

@aneeshusa
Copy link
Contributor

I believe you can use restartTriggers for this: https://github.com/NixOS/nixpkgs/search?q=restartTriggers&unscoped_q=restartTriggers

@markuskowa
Copy link
Member

You could use environment.etc."ipsec.conf". That creates a in /etc to the store path.

@ooesili
nixos/libreswan: use /etc/ipsec.conf as config
d20ec37 
It appears that the --config flags don't actually work, because
libreswan fails to start unless the config exists at /etc/ipsec.conf as
well. The simplest solution is just to exclusively use /etc/ipsec.conf
as a config file which seems to make libreswan happy.
@ooesili
Copy link
Contributor Author

ooesili commented Oct 13, 2018

@aneeshusa nice call, that totally worked. Just pushed up a change which I think actually made the diff smaller.

@mmahut
Copy link
Member

mmahut commented Aug 9, 2019

Any updates on this pull request, please?

@markuskowa
Copy link
Member

I would recommend to hold this PR back until libreswan is updated. Version 3.18, which is in nixpkgs, is from Jul 27, 2016. The most recent version is 3.29. When the problem still exists after the update we can merge this PR.

Note that there is also a CVE out for pre 3.28 versions.

@stale
Copy link

stale bot commented Jun 1, 2020

Thank you for your contributions.
This has been automatically marked as stale because it has had no activity for 180 days.
If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.
Here are suggestions that might help resolve this more quickly:

  1. Search for maintainers and people that previously touched the
    related code and @ mention them in a comment.
  2. Ask on the NixOS Discourse. 3. Ask on the #nixos channel on
    irc.freenode.net.

@stale stale bot added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jun 1, 2020
@iblech
Copy link
Contributor

iblech commented Oct 24, 2020

Not the original submitter, but I can confirm that this issue is still relevant and that the proposed fix works. To my eyes, it is ready to merge.

There is still another stumbling block which could be fixed in the future: ipsec does not start if the directory /etc/ipsec.d does not exist.

@stale stale bot removed the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Oct 24, 2020
@ooesili
Copy link
Contributor Author

ooesili commented Oct 30, 2020

I'm not using libreswan anymore (wireguard gang) so I'm not going to be able to validate changes to this PR. If someone else wants to carry across to the finish line, please do.

@rnhmjoj rnhmjoj mentioned this pull request May 16, 2021
Merged
10 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
6.topic: nixos 8.has: module (update) 9.needs: package (update) 10.rebuild-darwin: 0 10.rebuild-linux: 0 12. first-time contribution
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@ooesili @aneeshusa @markuskowa @mmahut @iblech @GrahamcOfBorg @Janik-Haag