[strongSwan] Looking for a way to debug resolve plugin

[Pavel Nikulin]

Hello,

I have an issue with resolve plugin failing to set nameserver records.
Following shows up in the log:

authentication of 'xxxxx' with EAP successful
IKE_SA xxxxx established between 192.168.0.140[192.168.0.140]...xxxxx[xxxxx]
scheduling reauthentication in 3333s
maximum IKE_SA lifetime 3513s
adding DNS server failed
adding DNS server failed
handling INTERNAL_IP4_DNS attribute failed
adding DNS server failed
handling INTERNAL_IP4_DNS attribute failed
installing new virtual IP x.x.x.x
installing new virtual IP xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ
CHILD_SA perfect-privacy{3} established with SPIs xxx and TS
x.x.x.x/32 xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/128 === 0.0.0.0/0
::/0
connection 'xxxxx' established successfully

I use openresolv (https://roy.marples.name/projects/openresolv) as my
resolvconf implementation.

I there any way to get more verbose output from resolve plugin? Any
suggestions about the cause?

[Tobias Brunner]

Hi Pavel,

Post by Pavel Nikulin
I use openresolv (https://roy.marples.name/projects/openresolv) as my
resolvconf implementation.

Does that provide /sbin/resolvconf?

Post by Pavel Nikulin
I there any way to get more verbose output from resolve plugin?

No, but errors returned from resolvconf are logged (which doesn't seem
to be the case).

Post by Pavel Nikulin
Any
suggestions about the cause?

It looks like it either happens early when executing resolvconf, or that
resolvconf was not found and opening /etc/resolv.conf for writing
failed. Otherwise, you'd have seen a log message about the installation
of the DNS server.

Regards,
Tobias

[Pavel Nikulin]

False alert,

I configured charon to run as unprivileged user, and forgot to add him
to resolvconf ground.

Post by Tobias Brunner
Hi Pavel,

Post by Pavel Nikulin
I use openresolv (https://roy.marples.name/projects/openresolv) as my
resolvconf implementation.

Does that provide /sbin/resolvconf?

Post by Pavel Nikulin
I there any way to get more verbose output from resolve plugin?

No, but errors returned from resolvconf are logged (which doesn't seem
to be the case).

Post by Pavel Nikulin
Any
suggestions about the cause?

It looks like it either happens early when executing resolvconf, or that
resolvconf was not found and opening /etc/resolv.conf for writing
failed. Otherwise, you'd have seen a log message about the installation
of the DNS server.
Regards,
Tobias