crash strongSwan in Ubuntu Trusty

[EOLE team]

[Impact]

 * Users report a crash when the revocation plugin is loaded, after a few rounds of IKE_SA reauthentication.

 * Users do not expect strongswan to crash under valid configurations.

[Test Case]

 * While not an explicit testcase, the original bug report indicates all that is needed is a loading of the revocation plugin and several runs of IKE_SA reauthentication. Upstream strongswan fixed this issue and referred to multiple reauthentication rounds being the primary culprit.

[Regression Potential]

 * Currently, the code crashes without this fix. Upstream has accepted this fix and applied it all versions. I believe the regression potential is very low, as the bug resulted from a coding error.

---

$ lsb_release -rd
Description: Ubuntu 14.04.5 LTS
Release: 14.04

$ apt-cache policy strongswan
strongswan:
  Installé : 5.1.2-0ubuntu2.4
  Candidat : 5.1.2-0ubuntu2.4
 Table de version :
 *** 5.1.2-0ubuntu2.4 0
        500 http://eole.ac-dijon.fr/ubuntu/ trusty-security/main amd64 Packages
        500 http://eole.ac-dijon.fr/ubuntu/ trusty-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     5.1.2-0ubuntu2 0
        500 http://eole.ac-dijon.fr/ubuntu/ trusty/main amd64 Packages

We have several production servers running with the same configuration.
When the plugin revocation is loaded, the daemon crashes in most every IKE_SA reauthentication (not each time).

You can see in this thread[1] what Tobias Brunner answers about our problem.
So, we have recompile the source package version including the joined patch (quilt), and all is OK now.

We would be grateful if you provide a new package including this patch.

Regards,
EOLE Team

[1] https://lists.strongswan.org/pipermail/users/2016-September/009991.html
[2] https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=8ca9a67f

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "fix-several-auth-crash" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Nish Aravamudan (nacc)]

Yakkety (and Xenial) have 5.3.5, and the requested fix was committed in 5.2.0. Will provide a PPA shortly to test the fix.

[Nish Aravamudan (nacc)]

Hello,

I have provided a test build at:

https://launchpad.net/~nacc/+archive/ubuntu/lp1629241

with the requested fix applied. Please test and report back!

[EOLE team (eole-team)]

Hello,

I have installed the new built package on a test server and a production server friday.
No crash happened with it.

Thanks.

[Brian Murray (brian-murray)]

Hello EOLE, or anyone else affected,

Accepted strongswan into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/strongswan/5.1.2-0ubuntu2.5 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[EOLE team (eole-team)]

Hello,

Yesterday, I have installed the trusty-proposed packages on the test server and the production server.
There is no problem with them.

Regards.

[Simon Déziel (sdeziel)]

Thanks for testing eole-team, marking as verification-done.

[Chris J Arges (arges)]

The verification of the Stable Release Update for strongswan has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package strongswan - 5.1.2-0ubuntu2.5

---------------
strongswan (5.1.2-0ubuntu2.5) trusty; urgency=medium

  * debian/patches/fix_reauth_crash.patch: auth-cfg: Fix crash after
    several reauthentications with multiple authentication rounds.
    Thanks to Tobias Brunner <email address hidden>.
    Closes LP: #1629241.

 -- Nishanth Aravamudan <email address hidden> Wed, 05 Oct 2016 15:43:30 -0700