fix error reported in openvswitch-ipsec.service startup log · Pull Request !218 · src-openEuler/openvswitch

fix error reported in openvswitch-ipsec.service startup log
https://gitee.com/src-openeuler/openvswitch/issues/ICSJM1?from=project-issue

原因分析：
在启动openvswitch-ipsec服务时，系统会刷新ipsec配置文件，在运行openvswitch-ipsec.service时生成/etc/ipsec.conf配置文件，同时会向其中写入相应内容。libreswan软件包的配置文件也位于/etc/ipsec.conf。在libreswan 4.15版本时，openvswitch应用了fix-the-problem-that-openvswitch-ipsec.service-causes-ipsec.service-to-fail-to-start.patch补丁，该补丁通过指定nssdir来兼容ipsec服务启动所需的参数。
随着libreswan升级至5.2版本，nssdir被删除，因此需要删除fix-the-problem-that-openvswitch-ipsec.service-causes-ipsec.service-to-fail-to-start.patch补丁，以确保openvswitch-ipsec.service和ipsec.service能够成功启动。

libreswan升级链接：https://gitee.com/src-openeuler/libreswan/pulls/100
![输入图片说明](https://foruda.gitee.com/images/1755076032564737864/e53fd9c2_12222356.png "屏幕截图")

修复前：

```
[root@openEuler ~]# uname -a
Linux openEuler 6.6.0-102.0.0.2.oe2509.x86_64 #1 SMP Fri Aug  8 01:19:23 CST 2025 x86_64 x86_64 x86_64 GNU/Linux
[root@openEuler ~]# rpm -qa openvswitch-ipsec
openvswitch-ipsec-3.3.1-1.oe2509.x86_64
[root@openEuler ~]# systemctl start openvswitch-ipsec.service
[root@openEuler ~]# systemctl status openvswitch-ipsec.service
● openvswitch-ipsec.service - OVS IPsec daemon
     Loaded: loaded (/usr/lib/systemd/system/openvswitch-ipsec.service; disabled; preset: disabled)
     Active: active (running) since Wed 2025-08-13 16:48:35 CST; 5s ago
    Process: 2075 ExecStart=/usr/share/openvswitch/scripts/ovs-ctl --ike-daemon=libreswan start-ovs-ipsec (code=exited, status=0/SUCCESS)
   Main PID: 2132 (ovs-monitor-ips)
      Tasks: 2 (limit: 21566)
     Memory: 25.7M ()
     CGroup: /system.slice/openvswitch-ipsec.service
             ├─2131 /usr/bin/python3 /usr/share/openvswitch/scripts/ovs-monitor-ipsec --pidfile=/var/run/openvswitch/ovs-monitor-ipsec.pid --ike-daemon=libreswan --log-file --detach -->
             └─2132 /usr/bin/python3 /usr/share/openvswitch/scripts/ovs-monitor-ipsec --pidfile=/var/run/openvswitch/ovs-monitor-ipsec.pid --ike-daemon=libreswan --log-file --detach -->

Aug 13 16:48:35 openEuler ovs-ctl[2090]: 2025-08-13T08:48:35Z |  6  | ovs-monitor-ipsec | INFO | Restarting LibreSwan
Aug 13 16:48:35 openEuler ovs-monitor-ips[2090]: ovs|  6  | ovs-monitor-ipsec | INFO | Restarting LibreSwan
Aug 13 16:48:35 openEuler ovs-ctl[2094]: Redirecting to: systemctl restart ipsec.service
Aug 13 16:48:35 openEuler systemctl[2094]: [systemctl restart ipsec.service] called by PID 2093 (/usr/bin/sh /usr/sbin/ipsec restart)
Aug 13 16:48:35 openEuler systemctl[2094]: Job for ipsec.service failed because the control process exited with error code.
Aug 13 16:48:35 openEuler systemctl[2094]: See "systemctl status ipsec.service" and "journalctl -xeu ipsec.service" for details.
Aug 13 16:48:35 openEuler ovs-monitor-ips[2132]: ovs|  8  | reconnect | INFO | unix:/var/run/openvswitch/db.sock: connecting...
Aug 13 16:48:35 openEuler ovs-monitor-ips[2132]: ovs|  11 | reconnect | INFO | unix:/var/run/openvswitch/db.sock: connected
Aug 13 16:48:35 openEuler systemd[1]: openvswitch-ipsec.service: Supervising process 2132 which is not our child. We'll most likely not notice when it exits.
Aug 13 16:48:35 openEuler systemd[1]: Started OVS IPsec daemon.
[root@openEuler ~]# systemctl status ipsec.service
× ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec
     Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled; preset: disabled)
     Active: failed (Result: exit-code) since Wed 2025-08-13 16:48:36 CST; 27s ago
       Docs: man:ipsec(8)
             man:pluto(8)
             man:ipsec.conf(5)
    Process: 2236 ExecStartPre=/usr/libexec/ipsec/addconn --config /etc/ipsec.conf --checkconfig (code=exited, status=0/SUCCESS)
    Process: 2238 ExecStartPre=/usr/sbin/ipsec checknss (code=exited, status=0/SUCCESS)
    Process: 2242 ExecStartPre=/usr/sbin/ipsec checknflog (code=exited, status=0/SUCCESS)
    Process: 2259 ExecStart=/usr/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork (code=exited, status=1/FAILURE)
    Process: 2262 ExecStopPost=/usr/sbin/ipsec stopnflog (code=exited, status=0/SUCCESS)
   Main PID: 2259 (code=exited, status=1/FAILURE)
     Status: "Exited."
      Error: 1 (Operation not permitted)

Aug 13 16:48:36 openEuler systemd[1]: ipsec.service: Scheduled restart job, restart counter is at 5.
Aug 13 16:48:36 openEuler systemd[1]: ipsec.service: Start request repeated too quickly.
Aug 13 16:48:36 openEuler systemd[1]: ipsec.service: Failed with result 'exit-code'.
Aug 13 16:48:36 openEuler systemd[1]: Failed to start Internet Key Exchange (IKE) Protocol Daemon for IPsec.
```
修复后：

```
[root@openEuler ~]# rpm -qa openvswitch-ipsec
openvswitch-ipsec-3.3.1-2.oe2509.x86_64
[root@openEuler ~]# systemctl restart openvswitch-ipsec.service
[root@openEuler ~]# systemctl status openvswitch-ipsec.service
● openvswitch-ipsec.service - OVS IPsec daemon
     Loaded: loaded (/usr/lib/systemd/system/openvswitch-ipsec.service; disabled; preset: disabled)
     Active: active (running) since Wed 2025-08-13 16:51:27 CST; 4s ago
    Process: 2473 ExecStart=/usr/share/openvswitch/scripts/ovs-ctl --ike-daemon=libreswan start-ovs-ipsec (code=exited, status=0/SUCCESS)
   Main PID: 2547 (ovs-monitor-ips)
      Tasks: 2 (limit: 21566)
     Memory: 18.5M ()
     CGroup: /system.slice/openvswitch-ipsec.service
             ├─2546 /usr/bin/python3 /usr/share/openvswitch/scripts/ovs-monitor-ipsec --pidfile=/var/run/openvswitch/ovs-monitor-ipsec.pid --ike-daemon=libreswan --log-file --detach -->
             └─2547 /usr/bin/python3 /usr/share/openvswitch/scripts/ovs-monitor-ipsec --pidfile=/var/run/openvswitch/ovs-monitor-ipsec.pid --ike-daemon=libreswan --log-file --detach -->

Aug 13 16:51:27 openEuler ovs-ctl[2488]: 2025-08-13T08:51:27Z |  5  | ovs-monitor-ipsec | INFO | Restarting IKE daemon
Aug 13 16:51:27 openEuler ovs-monitor-ips[2488]: ovs|  5  | ovs-monitor-ipsec | INFO | Restarting IKE daemon
Aug 13 16:51:27 openEuler ovs-ctl[2488]: 2025-08-13T08:51:27Z |  6  | ovs-monitor-ipsec | INFO | Restarting LibreSwan
Aug 13 16:51:27 openEuler ovs-monitor-ips[2488]: ovs|  6  | ovs-monitor-ipsec | INFO | Restarting LibreSwan
Aug 13 16:51:27 openEuler ovs-ctl[2492]: Redirecting to: systemctl restart ipsec.service
Aug 13 16:51:27 openEuler systemctl[2492]: [systemctl restart ipsec.service] called by PID 2491 (/usr/bin/sh /usr/sbin/ipsec restart)
Aug 13 16:51:27 openEuler ovs-monitor-ips[2547]: ovs|  8  | reconnect | INFO | unix:/var/run/openvswitch/db.sock: connecting...
Aug 13 16:51:27 openEuler ovs-monitor-ips[2547]: ovs|  11 | reconnect | INFO | unix:/var/run/openvswitch/db.sock: connected
Aug 13 16:51:27 openEuler systemd[1]: openvswitch-ipsec.service: Supervising process 2547 which is not our child. We'll most likely not notice when it exits.
Aug 13 16:51:27 openEuler systemd[1]: Started OVS IPsec daemon.
[root@openEuler ~]# systemctl status ipsec.service
● ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec
     Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled; preset: disabled)
     Active: active (running) since Wed 2025-08-13 16:51:27 CST; 16s ago
       Docs: man:ipsec(8)
             man:pluto(8)
             man:ipsec.conf(5)
    Process: 2506 ExecStartPre=/usr/libexec/ipsec/addconn --config /etc/ipsec.conf --checkconfig (code=exited, status=0/SUCCESS)
    Process: 2509 ExecStartPre=/usr/sbin/ipsec checknss (code=exited, status=0/SUCCESS)
    Process: 2512 ExecStartPre=/usr/sbin/ipsec checknflog (code=exited, status=0/SUCCESS)
   Main PID: 2527 (pluto)
     Status: "Startup completed."
      Tasks: 4 (limit: 21566)
     Memory: 3.9M ()
     CGroup: /system.slice/ipsec.service
             └─2527 /usr/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork

Aug 13 16:51:27 openEuler pluto[2527]: addconn: Kernel supports NIC esp-hw-offload
Aug 13 16:51:27 openEuler pluto[2527]: addconn: adding interface eth0 9.82.200.122:UDP/500
Aug 13 16:51:27 openEuler pluto[2527]: addconn: adding interface eth0 9.82.200.122:UDP/4500 (NAT)
Aug 13 16:51:27 openEuler pluto[2527]: addconn: adding interface lo 127.0.0.1:UDP/500
Aug 13 16:51:27 openEuler pluto[2527]: addconn: adding interface lo 127.0.0.1:UDP/4500 (NAT)
Aug 13 16:51:27 openEuler pluto[2527]: addconn: adding interface lo [::1]:UDP/500
Aug 13 16:51:27 openEuler pluto[2527]: addconn: adding interface lo [::1]:UDP/4500 (NAT)
Aug 13 16:51:27 openEuler pluto[2527]: addconn:
Aug 13 16:51:27 openEuler pluto[2527]: addconn: loading secrets from "/etc/ipsec.secrets"
Aug 13 16:51:27 openEuler pluto[2527]: addconn:
```

src-openEuler/openvswitch .gitee-modal { width: 500px !important; }

搜索帮助

src-openEuler/openvswitch