strongswan / govici Goto Github PK

Hi guys,

I have a bug, this is my code:

func TestFunc() {
s, err := vici.NewSession()
if err != nil {
fmt.Fprintf(os.Stderr, "vici NewSession failed!")
return
}
// Register event listener for 'ike-updown' events.
if err := s.Listen(context.Background(), "ike-updown"); err != nil {
fmt.Fprintf(os.Stderr,"vici Listen failed!")
s.Close()
return
}
for {
e, err := s.NextEvent()
if err != nil {
s.Close()
fmt.Fprintf(os.Stderr,"vici is closed.")
return
} else {
fmt.Fprintf(os.Stderr,"receive an event.")
}
}
}

When the charon is alive,  everything goes well, but when charon is restarted, s.NextEvent() will get an error, if I call s.Close() to close the session, the function will be hung, but if I don't call s.Close(), the file handle opened cannot be closed.

I debug the code, and find the s.Close is hung by chan.

func (s *Session) Close() error {
...............................................
s.emux.RLock()
if s.el != nil {
if err := s.el.Close(); err != nil {------------>The code is hung here
return err
}
}
...........................................
return nil
}

To find more exact code in s.el.Close,
func (el *eventListener) Close() error {
// Cancel the event listener context, and
// wait for the destroy context to be done.
el.cancel()
<-el.dctx.Done() ---------------------------->this is the exact code line
return nil
}

In func s.Listen()

func (el *eventListener) listen(events []string) (err error) {
...............................
go func() {
defer el.destroy()
for {
...........................................................
default:
var e event
_ = el.conn.SetReadDeadline(time.Now().Add(time.Second))

			p, err := el.recv()
			if err != nil {
				if ne, ok := err.(net.Error); ok && ne.Timeout() {
					continue
				}
				e.err = err
                                 // Send error event and continue in loop.
			**el.ec <- e ----------------------------->I find the code is hung here, so no one call  el.destroy(), that's why I cannot close the session.**
                                    continue
			}

			if p.ptype == pktEvent {
				e.msg = p.msg
				el.ec <- e
			}
		}
	}
}()

return nil

}

Best,

We've been investigating possible deadlock when the Vici socket disappears (e.g. StrongSwan crashes or otherwise goes away). It appears deadlock happens under the following order of circumstances:

1. An event is registered with govici Session.
2. Socket goes away.
3. Close method is called on the govici Session.
4. Blocked indefinitely.

Deadlock does not occur unless an event is registered.

We've isolated it to a hard loop in the event listener once vici: transport error: EOF occurs.

Due to the recv method being called on the event listener repeatedly even after the first EOF occurs, the event channel (el.ec) fills up with 16 errors. Once this happens, the following code causes deadlock since the channel is now blocked and the mutex remains locked:

			el.emux.Lock()
			if len(el.events) > 0 {
				el.ec <- Event{err: err}
			}
			el.emux.Unlock()

Calling session.Close then remains blocked forever.

We were able to create a temporary patch by returning the EOF error directly from the recv method and in the event we receive an EOF, we return from the listener instead of continuing:

                        el.emux.Lock()
			if len(el.events) > 0 {
				el.ec <- Event{err: err}
			}
			el.emux.Unlock()

			if err == io.EOF {
				return
			}

Test Program:

	session, err := vici.NewSession()
	if err != nil {
		panic(err)
	}

	err = session.Subscribe("child-updown")
	if err != nil {
		panic(err)
	}

	fmt.Println("About to Sleep: Stop StrongSwan Now")
	time.Sleep(5 * time.Second)
	fmt.Println("Waking Up, closing Session")

	err = session.Close()
	if err != nil {
		panic(err)
	}

	fmt.Println("Done")

I started looking at govici documentation and sample code. I see that, it has implemented some of the 'swanctl load-*' commands like load-conn. I could not find 'load-creds' equivalent command though.
Is this implemented already?

Since go 1.13 introduced the Value.IsZero convenience method to the reflect package, I tried using this function instead of the emptyMessageElement function. I.e.,

diff --git a/vici/message.go b/vici/message.go
index 8daf7c9..7f2cf6e 100644
--- a/vici/message.go
+++ b/vici/message.go
@@ -829,7 +829,7 @@ func (m *Message) marshalFromStruct(rv reflect.Value) error {
 			continue
 		}
 
-		if emptyMessageElement(rfv) {
+		if rfv.IsZero() {
 			continue
 		}

However, this causes TestMarshalBoolFalse to fail...

=== RUN   TestMarshalBoolFalse
    TestMarshalBoolFalse: message_marshal_test.go:128: Marshalled boolean value is invalid.
        Expected: no
        Received: <nil>

...meaning our definition of an "empty" element is not consistent with the reflect package (42761e7 should have been a clue). As it stands, the emptyMessageElement is "correct" according to our test cases, but I am of the opinion this function should be consistent with reflect.Value.IsZero since it was originally written due to the absence of such a method in reflect.

I was looking into this code because I wanted to add an omitempty tag option to allow more flexibility to marshaling.

Describe the bug
Channels registered with NotifyEvents() are not closed when session transport recv() fails thus making it impossible to detect session disconnect from strongSwan.

To Reproduce
Subscribe to some events, register notification channel with NotifyEvents() and then restart strongSwan.

Expected behavior
Registered notification channel should be closed or there must be some another way to detect session disconnect and consequent event listener loop stop.

Screenshots
N/A

Version information

• vici package version: 0.6.0
• StrongSwan version: 5.8.2

Additional context
swanctl --monitor-sa doesn't detect strongSwan restarts too but Python implementation does. And as I understand old deprecated NextEvent() call handles this situation correctly.

Explore adding APIs inspired by package signal for working with vici events.

This is also targeted for v1.0 because it may be worth removing the NextEvent method in favor of these.

I use the example test case in getting started article .

type connection struct {
	Name string // This field will NOT be marshaled!

	LocalAddrs []string            `vici:"local_addrs"`
	Local      *localOpts          `vici:"local"`
	Remote     *remoteOpts         `vici:"remote"`
	Children   map[string]*childSA `vici:"children"`
	Version    int                 `vici:"version"`
	Proposals  []string            `vici:"proposals"`
}

type localOpts struct {
	Auth  string   `vici:"auth"`
	Certs []string `vici:"certs"`
	ID    string   `vici:"id"`
}

type remoteOpts struct {
	Auth string `vici:"auth"`
}

type childSA struct {
	LocalTrafficSelectors []string `vici:"local_ts"`
	Updown                string   `vici:"updown"`
	ESPProposals          []string `vici:"esp_proposals"`
}

func loadConn(conn connection) error {
	s, err := vici.NewSession()
	if err != nil {
		return err
	}
        defer s.Close()

	c, err := vici.MarshalMessage(&conn)
	if err != nil {
		return err
	}

        m := vici.NewMessage()
        if err := m.Set(conn.Name, c); err != nil {
                return err
        }

	_, err = s.CommandRequest("load-conn", m)

	return err
}

Function of CommandRequest return failed, charon vici module create cert failed, the log like this:

15[LIB]   file coded in unknown format, discarded
15[LIB] building CRED_CERTIFICATE - X509 failed, tried 4 builders

strongswan version is 5.9.0.

With go 1.18 coming, it would be good to investigate the use of generics in the vici API. On area that may be useful is around the Message type, since we currently use a map[string]interface{} under the hood. Using generics in the vici package would introduce breaking changes, which is why this is an issue targeted for a future v1.0 tag.

Describe the bug

The select pattern

To Reproduce

// You can edit this code!
// Click here and start typing.
package main

import (
	"fmt"
	"sync"
	"time"
)

func main() {

	var c = make(chan int, 16)

	var wg sync.WaitGroup
	wg.Add(1)

	go func() {
		defer wg.Done()
		for {
			select {
			case v, ok := <-c:
				if !ok {
					return
				}
				fmt.Println(v)
				time.Sleep(time.Microsecond)
			}
		}
	}()

	for i := 0; i < 100; i++ {
		select {
		case c <- i:
		default:
			fmt.Printf("dropping %d\n", i)
		}

	}
	close(c)
	wg.Wait()
}

https://go.dev/play/p/hUQThyF0Tmf

Expected behavior

Message delivery should be reliant; current behavior could potentially cause a loss of events. The previous implementation blocks rather than dropping messages. If this pattern is preferable for your implementation, please provide some drop counters per event as exported field/function to be transparent on the loss of events.

Screenshots
If applicable, add screenshots to help explain your problem.

Version information
v0.6.0

Additional context
Add any other context about the problem here.

The event listening API is currently a little awkward. A caller must register for all event types at once in a call to Listen, and can only unsubscribe (all or nothing) by closing the Session or cancelling the context provided to Listen. Ideally, a caller should be able to dynamically sub/unsub from a given event(s).

The new (not backwards compatible) API might look like:

func (s *Session) Subscribe(events ...string) error
func (s *Session) Unsubscribe(events ...string) error
func (s *Session) UnsubscribeAll() error

See the original suggestion from @seglberg .

As suggested by @seglberg in #17, the packet/event name should be exposed when the event is received. This will allow code like:

for {
        e, err := s.NextEvent()
        if err != nil {
                // handle err
        }
        switch e.Name() { // Just an example
        case "event1":
                // handle event1
        case "event2":
                // handle event2
        }
}

Since the package has not yet reached v1.0.0, we will likely break the API here rather than adding an awkward extension.

Currently, the only public API is vici.WithSocketPath. I'd like to be able to do vici.WithConn, and pass in an already constructed connection. Or, at the very least, be able to pass in a "network", "address", and net.Dialer.

Use case: I'm using govici library and running strongswan in a couple docker containers. I have the vici interface configured to listen on a TCP port so that I can expose it from the container.

Describe the bug
This example has a panic event-listener
panic: interface conversion: interface {} is nil, not *vici.Message

Version information

• vici package version: v0.5.0
• StrongSwan version: 5.9.0

I have another issue, I don't know how does this happen, this is the code:

func (t *transport) recv() (*packet, error) {
buf := make([]byte, headerLength)
t.conn.SetReadDeadline(time.Now().Add(time.Second * 20))
_, err := t.conn.Read(buf)
if err != nil {
if ne, ok := err.(net.Error); ok && ne.Timeout() {
return nil, ne
}
return nil, fmt.Errorf("%v: %v", errTransport, err)
}

================================================================
pl := binary.BigEndian.Uint32(buf)
//netbank.cn
need check the validity of buf length, because sometime the length may be a very very big number, I don't know why
if pl > 1024*10 {
fmt.Fprintf(os.Stderr, "vici recv len %v\n, %s", pl, debug.Stack())
return nil, fmt.Errorf("vici error: recv wrong data len %v", pl)
}
//netbank.cn
================================================================

buf = make([]byte, int(pl))
_, err = t.conn.Read(buf)
if err != nil {
	return nil, fmt.Errorf("%v: %v", errTransport, err)
}

p := &packet{}
err = p.parse(buf)
if err != nil {
	return nil, err
}

return p, nil
}

Best,

I feel like more examples and maybe more unit tests are required. Usually if the documentation is not enough, you can go through the unit tests to see how the mod is supposed to work. After an hour of hacking, I managed to get some code working to get a list of EAP IDs:

package main

import (
	"fmt"

	"github.com/strongswan/govici"
)

func main() {
	session, err := vici.NewSession()
	if err != nil {
		fmt.Println(err)
		return
	}
	defer session.Close()

	ms, err := session.StreamedCommandRequest("list-sas", "list-sa", nil)
	if err != nil {
		fmt.Println("got error starting message stream: ", err)
		return
	}

	userCounter := 1
	for _, m := range ms.Messages() {
		for _, k := range m.Keys() {
			sa := m.Get(k)
			remoteID := struct {
				RemoteID string `vici:"remote-eap-id"`
			}{}
			err := vici.UnmarshalMessage(sa.(*vici.Message), &remoteID)
			if err != nil {
				fmt.Println("got error: ", err)
			} else {
				fmt.Println("user ", userCounter, " is ", remoteID)
				userCounter++
			}
		}
	}
}

Printing stuff out and unmarshalling after that is also a bit painful. It would help to have predefined types with all the messages you can get.

The MessageStream type is an unneeded abstraction for a list of Message's. Removing this would be a breaking change, but may be worth it for API simplicity in v1.0.

In lieu of Travis, and for simplicity, setup github actions for CI.

Hello.

The very 1st example from the readme isn't workig:

daemon: charon-systemd
version: 5.7.2
sysname: Linux
release: 4.19.0-6-amd64
machine: x86_64
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x48 pc=0x531840]

goroutine 1 [running]:
github.com/strongswan/govici.(*eventListener).Close(0x0, 0xc0000ae000, 0xc000040eb8)
        /root/go/src/github.com/strongswan/govici/events.go:75 +0x20
github.com/strongswan/govici.(*Session).Close(0xc000078630, 0x0, 0x2)
        /root/go/src/github.com/strongswan/govici/session.go:76 +0x33
main.main()
        /root/go/src/gitlab.oubcom.net/linux/nagios-plugins/nrpe/check_swan_cert/main.go:126 +0x2fc

It seems to be caused by an attempt to Close() the Session, which in turn tries to Close() the eventListener. As there is no eventListener registered at this point, the program crashes.

Quick hack in the Close() function in session.go seems to resolve the issue:

if s.el != nil {
  if err := s.el.Close(); err != nil {
    return err
  }
}

Moving to Go modules is straight forward, but one thing to consider is whether this package should change its import path. Right now, we do not use the canonical import path (a vestige from before moving the package to its final home). This means that if your source files are goimports -s-ed, then you have:

import (
        vici "github.com/strongswan/govici"
)

Since this is not best practice for a package, I would like to use migration to Go modules as an opportunity to make sure this package does follow best practices.

I think the simplest option is to initialize the go module as github.com/strongswan/govici, and move the existing *.go files to vici/ sub-directory. This does mean that existing users of the package will have to change their import paths to github.com/strongswan/govici/vici when they uprev to v0.1.0.

In https://www.strongswan.org/apidoc/md_src_libcharon_plugins_vici_README.html document, we have load-key() and unload_key() methods, and has load-cert() method also, but has't unload_cert() method , how can I delete the cert which load from vici protocol? Thank you!

I have started using govici a while ago.

I have noticed the default rekey time for child SA is 1h and connection is 4h. I noticed that, after 1h, child attempts to rekey and eventually fails.
To check this, I disabled connection rekey_time to 0 (so that rekey is disabled). for child SA, I set it to 180 seconds.
My expectation is child SA will try to rekey once rekey timer reaches 0 and timer should again start from 180.
But after 180 seconds, rekeying process starts and it does not succeed.

In child SA section , I am only setting following fields:
mark_in, mark_out, start_action=start, local_ts, remote_ts, rekey_time=180.

Am I missing something for rekey to succeed?

Here is the 'ipsec statusall' output 1. just before rekey starts, 2. during rekeying process and 3. eventual failure.

1. just before rekey starts:
   Security Associations (1 up, 0 connecting):
   conn[1]: ESTABLISHED 2 minutes ago, 21.0.109.180[104.134.28.12]...35.242.127.5[35.242.127.5]
   conn[1]: IKEv2 SPIs: f2103158733a4a12_i* 79e84ab3fc1b1427_r, rekeying disabled
   conn[1]: IKE proposal: AES_GCM_8_128/PRF_AES128_XCBC/MODP_2048
   connchild{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c6a77bac_i 789afd30_o
   connchild{1}: AES_CBC_128/HMAC_SHA2_256_128, 0 bytes_i, 0 bytes_o, rekeying in 1 second
   connchild{1}: 0.0.0.0/0 === 0.0.0.0/0

2. during rekeying
   conn[1]: ESTABLISHED 2 minutes ago, 21.0.109.180[104.134.28.12]...35.242.127.5[35.242.127.5]
   conn[1]: IKEv2 SPIs: f2103158733a4a12_i* 79e84ab3fc1b1427_r, rekeying disabled
   conn[1]: IKE proposal: AES_GCM_8_128/PRF_AES128_XCBC/MODP_2048
   connchild{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c6a77bac_i 789afd30_o
   connchild{1}: AES_CBC_128/HMAC_SHA2_256_128, 0 bytes_i, 0 bytes_o, rekeying active
   connchild{1}: 0.0.0.0/0 === 0.0.0.0/0

3. eventually after few seconds
   conn[1]: ESTABLISHED 3 minutes ago, 21.0.109.180[104.134.28.12]...35.242.127.5[35.242.127.5]
   conn[1]: IKEv2 SPIs: f2103158733a4a12_i* 79e84ab3fc1b1427_r, rekeying disabled
   conn[1]: IKE proposal: AES_GCM_8_128/PRF_AES128_XCBC/MODP_2048
   ====> why is this happening ?