[strongSwan-dev] 5.6.2 regression? dns attributes are lost

[Harald Dunkel]

Hi folks,

using the new strongswan 5.6.2 (on Stretch) together with the
old network-manager-strongswan 1.4.2 the nameserver entries
in /etc/resolv.conf are broken. They contain some fantasy IP
addresses, AFAICS. The domain search list is OK.

On the peer I am using Strongswan 5.6.1, esp. the attr plugin:

attr {
# <attr> is an attribute name or an integer, values can be an IP address,
# subnet or arbitrary value.
# <attr> =
dns = 10.0.96.124
dns1 = 10.0.96.123
dns2 = 10.0.96.124
nbns = 10.0.98.253
28674 = ac.example.de vs.example.de ws.example.de example.de
28675 = ac.example.de vs.example.de ws.example.de example.de

# Whether to load the plugin. Can also be an integer to increase the
# priority of this plugin.
load = yes
}

Do I have to upgrade n-m-s to version 1.4.3 for Strongswan 5.6.2?


Regards
Harri

[Tobias Brunner]

Hi Harri,

Post by Harald Dunkel
Do I have to upgrade n-m-s to version 1.4.3 for Strongswan 5.6.2?

I don't think so. But the backend was migrated from libnm-glib to libnm
which required changes in how the data is passed to NM (see [1] for the
commit). Could be that something went wrong there. For instance, it
may not actually be necessary to call g_variant_new_unint32() on line 69
in nm_service.c. It might just be enough to pass the value. Could you
try the patch in the nm-dns-fix branch.

Regards,
Tobias

[1] https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=9a71b721

[Harald Dunkel]

Hi Tobias,

Post by Tobias Brunner
Hi Harri,

Post by Harald Dunkel
Do I have to upgrade n-m-s to version 1.4.3 for Strongswan 5.6.2?

I don't think so. But the backend was migrated from libnm-glib to libnm
which required changes in how the data is passed to NM (see [1] for the
commit). Could be that something went wrong there. For instance, it
may not actually be necessary to call g_variant_new_unint32() on line 69
in nm_service.c. It might just be enough to pass the value. Could you
try the patch in the nm-dns-fix branch.

Yup, thats it. After including your patch into strongswan 5.6.2
/etc/resolv.conf is setup correctly (still using NM applet 1.4.2).


Thanx very much
Harri