Knockd service fails to start due to missing dependency

[Ivo Straka]

[impact]

knockd doesn't correctly start at boot

[test case]

install a test system; linux mint (from comment 5) or plain ubuntu

check if any installed-by-default services pull in network-online.target:

$ systemctl list-dependencies --reverse network-online.target
network-online.target

if any services are listed as reverse deps, disable or uninstall them; for example, with the default lxd container image:

ubuntu@lp1912826-f:~$ systemctl list-dependencies --reverse network-online.target
network-online.target
● ├─cloud-config.service
● ├─cloud-final.service
● ├─iscsid.service
● └─open-iscsi.service

so those services need to be disabled, or the packages uninstalled, so there are no services that Want=network-online.target.

Then install knockd and configure (see comment 5) and reboot, and confirm that knockd is started (and fails) before networking starts. Also check that network-online.target is still unwanted, and thus not started, so knockd isn't delayed until after the network is up.

[regression potential]

any regression would likely cause knockd to fail to correctly start; regressions after starting up are unlikely.

[scope]

this is needed in b/f/g/h

[other info]

note that this project seems essentially dead upstream, the last official release was 2014:
https://www.zeroflux.org/projects/knock

[original description]

I would like to request a small fix in the systemd unit file knockd.service. Please add the [Unit] line

Wants=network-online.target

Bug description:
When the system starts, the knockd daemon fails with a message "knockd[1012]: could not open eno1: eno1: That device is not up". This bug was also described here:
https://bugzilla.redhat.com/show_bug.cgi?id=1730634

In accordance with the recommendations in the systemd.unit documentation, it should be sufficient to accompany the After= option with a Wants= option.

This fixed the issue for me; and in the syslog I could see that the network manager comes online before the knockd daemon (as required), instead of after.

Tested on Linux Mint 20.1 that is based on Ubuntu focal (knockd 0.7-1ubuntu3).

[Dan Streetman (ddstreet)]

@ivo-straka I can't reproduce any failure, can you provide test case steps to reproduce this please

[Ivo Straka (ivo-straka)]

I am not sure what exactly makes the error reproducible. I encounter this error at work, on a computer with freshly installed Linux Mint 20.1 MATE.

1. install the package knockd
2. configure /etc/knockd.conf, set Interface
3. edit /etc/default/knockd to set START_KNOCKD=1
4. enable knockd.service
5. restart the system

I tried at home, where I run the same system (although not freshly installed, but gradually upgraded), and knockd starts succcessfully.

I also remember having a similar problem some time ago on other machines at work; at the time I solved it by placing a System V init script to /etc/network/if-up.d/. This might mean that the problem depends on the network.

If it helps, I can try installing Ubuntu on a side partition at work and try it from scratch again. I suspect that maybe if the NetworkManager takes too long to bring an interface online, knockd fails. The positions of the syslog entries of NetworkManager and knockd correspond with the error happening. In comment #4 of the linked RH bug, J. Ralston claims that the After= condition is insufficient by itself if the service in question requires a dependency to be fully up and running.

[Dan Streetman (ddstreet)]

I'll upload the fix to hirsute, but before backporting there needs to be some steps to reproduce, even if it's intermittent

[Launchpad Janitor (janitor)]

This bug was fixed in the package knockd - 0.7-1ubuntu4

---------------
knockd (0.7-1ubuntu4) hirsute; urgency=medium

  * d/knockd.service:
    - use Wants=network-online.target (LP: #1912826)

 -- Dan Streetman <email address hidden> Mon, 25 Jan 2021 16:12:41 -0500

[Ivo Straka (ivo-straka)]

Here are the steps I used to reproduce the bug:

1. install Linux Mint 20.1 MATE
2. install package knockd
3. in /etc/knockd.conf, add Interface = eno1 (or your network interface)
4. in /etc/default/knockd, set START_KNOCKD=1
5. run "sudo systemctl enable knockd"
6. restart
7. after restarting, knockd is not up - it failed due to eno1 not being up

I also tried to reproduce the bug on Ubuntu Desktop 20.04 LTS (focal), minimal install variant. However, no bug occurred. Mint 20.1 is based on focal and uses the same knockd package version, but the bug occurred only on Mint.

According to syslog (short version attached), it appears that even the kernel loaded the network card after knockd tried to connect. It is possible that how fast the system brings the network up depends on other software and Ubuntu just happens to be faster.

If you'd like the whole syslog, I'll e-mail it privately. Also let me know if I can help by doing some additional tests. Thank you!

[Dan Streetman (ddstreet)]

uploaded for b/f/g, thanks!

[Brian Murray (brian-murray)]

Hello Ivo, or anyone else affected,

Accepted knockd into groovy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/knockd/0.7-1ubuntu3.20.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-groovy to verification-done-groovy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-groovy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello Ivo, or anyone else affected,

Accepted knockd into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/knockd/0.7-1ubuntu3.20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello Ivo, or anyone else affected,

Accepted knockd into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/knockd/0.7-1ubuntu1.18.04.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Dan Streetman (ddstreet)]

root@lp1912826-g:~# dpkg -l|grep knockd
ii knockd 0.7-1ubuntu3 amd64 small port-knock daemon
root@lp1912826-g:~# systemctl is-enabled knockd
enabled
root@lp1912826-g:~# systemctl list-dependencies --reverse network-online.target
network-online.target

root@lp1912826-g:~# dpkg -l|grep knockd
ii knockd 0.7-1ubuntu3.20.10.1 amd64 small port-knock daemon
root@lp1912826-g:~# systemctl is-enabled knockd
enabled
root@lp1912826-g:~# systemctl list-dependencies --reverse network-online.target
network-online.target
● └─knockd.service

[Dan Streetman (ddstreet)]

root@lp1912826-f:~# dpkg -l|grep knockd
ii knockd 0.7-1ubuntu3 amd64 small port-knock daemon
root@lp1912826-f:~# systemctl is-enabled knockd
enabled
root@lp1912826-f:~# systemctl list-dependencies --reverse network-online.target
network-online.target

root@lp1912826-f:~# dpkg -l|grep knockd
ii knockd 0.7-1ubuntu3.20.04.1 amd64 small port-knock daemon
root@lp1912826-f:~# systemctl is-enabled knockd
enabled
root@lp1912826-f:~# systemctl list-dependencies --reverse network-online.target
network-online.target
● └─knockd.service

[Dan Streetman (ddstreet)]

root@lp1912826-b:~# dpkg -l|grep knockd
ii knockd 0.7-1ubuntu1.18.04.2 amd64 small port-knock daemon
root@lp1912826-b:~# systemctl is-enabled knockd
enabled
root@lp1912826-b:~# systemctl list-dependencies --reverse network-online.target
network-online.target

root@lp1912826-b:~# dpkg -l|grep knockd
ii knockd 0.7-1ubuntu1.18.04.3 amd64 small port-knock daemon
root@lp1912826-b:~# systemctl is-enabled knockd
enabled
root@lp1912826-b:~# systemctl list-dependencies --reverse network-online.target
network-online.target
● └─knockd.service

[Ivo Straka (ivo-straka)]

I can confirm that the issue is resolved after updating knockd from focal-proposed on Mint 20.1. Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package knockd - 0.7-1ubuntu3.20.10.1

---------------
knockd (0.7-1ubuntu3.20.10.1) groovy; urgency=medium

  * d/knockd.service:
    - use Wants=network-online.target (LP: #1912826)

 -- Dan Streetman <email address hidden> Mon, 25 Jan 2021 16:14:17 -0500

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for knockd has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package knockd - 0.7-1ubuntu3.20.04.1

---------------
knockd (0.7-1ubuntu3.20.04.1) focal; urgency=medium

  * d/knockd.service:
    - use Wants=network-online.target (LP: #1912826)

 -- Dan Streetman <email address hidden> Mon, 25 Jan 2021 16:15:23 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package knockd - 0.7-1ubuntu1.18.04.3

---------------
knockd (0.7-1ubuntu1.18.04.3) bionic; urgency=medium

  * d/knockd.service:
    - use Wants=network-online.target (LP: #1912826)

 -- Dan Streetman <email address hidden> Mon, 25 Jan 2021 16:16:15 -0500