wireguard dkms systemd

wireguard dkms systemd

[Lucian Cristian]

updating the wireguard module on systemd based linux gives

Warning: The unit file, source configuration file or drop-ins of 
wg-quick@wg0.service changed on disk. Run 'systemctl daemon-reload' to 
reload units.
Sleeping 3 seconds...

can this be fixed int the restart script ?

the tunnel won't come up if the unit is not reloaded

Thank you !

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Robert-André Mauchin]

On samedi 20 octobre 2018 22:59:17 CEST Lucian Cristian wrote:
> updating the wireguard module on systemd based linux gives
> 
> Warning: The unit file, source configuration file or drop-ins of
> wg-quick@wg0.service changed on disk. Run 'systemctl daemon-reload' to
> reload units.
> Sleeping 3 seconds...
> 
> can this be fixed int the restart script ?
> 
> the tunnel won't come up if the unit is not reloaded
> 
> Thank you !
> 

It depends on how you install Wireguard; normally such thing is handled by 
your package manager. You should contact your package maintainer if this is 
not the case.


_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Jordan Glover]

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Saturday, October 20, 2018 10:59 PM, Lucian Cristian <luci@powerneth.ro> wrote:

> updating the wireguard module on systemd based linux gives
>
> Warning: The unit file, source configuration file or drop-ins of
> wg-quick@wg0.service changed on disk. Run 'systemctl daemon-reload' to
> reload units.
> Sleeping 3 seconds...
>

This has nothing to do with dkms. Systemd units are part of
wireguard-tools package.

> can this be fixed int the restart script ?
>

There isn't a "restart script" in any wireguard package.

> the tunnel won't come up if the unit is not reloaded
>

Then reload it. You have exact command printed.

> Thank you !

Jordan

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Jonathon Fernyhough]

[-- Attachment #1.1.1: Type: text/plain, Size: 529 bytes --]

On 20/10/2018 21:59, Lucian Cristian wrote:
> updating the wireguard module on systemd based linux 

How are you updating Wireguard, and on which Linux distro?

> gives
> 
> Warning: The unit file, source configuration file or drop-ins of
> wg-quick@wg0.service changed on disk. Run 'systemctl daemon-reload' to
> reload units.
> Sleeping 3 seconds...
> 
> can this be fixed int the restart script ?
> 

This sounds more like a packaging/system administration issue rather
than a Wireguard or systemd issue.



[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Lucian Cristian]

On 21.10.2018 15:12, Jordan Glover wrote:
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Saturday, October 20, 2018 10:59 PM, Lucian Cristian <luci@powerneth.ro> wrote:
>
>> updating the wireguard module on systemd based linux gives
>>
>> Warning: The unit file, source configuration file or drop-ins of
>> wg-quick@wg0.service changed on disk. Run 'systemctl daemon-reload' to
>> reload units.
>> Sleeping 3 seconds...
>>
> This has nothing to do with dkms. Systemd units are part of
> wireguard-tools package.
>
>> can this be fixed int the restart script ?
>>
> There isn't a "restart script" in any wireguard package.
>
>> the tunnel won't come up if the unit is not reloaded
>>
> Then reload it. You have exact command printed.
>
>> Thank you !
> Jordan
>
ubuntu,

is an annoyance to restart it manually, if you are inside the vpn, you 
can't do it, I thought that there is a restart script at package update..


Regards
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Daniel Kahn Gillmor]

On Sun 2018-10-21 18:49:19 +0300, Lucian Cristian wrote:
> is an annoyance to restart it manually, if you are inside the vpn, you 
> can't do it, I thought that there is a restart script at package update..

as a packager (debian, not ubuntu, but priniciples might be similar
across operating systems), i'm very leery to automatically restart
services during an upgrade, particularly when those services might
affect the connectivity of the system administrator who is doing the
upgrade.

that means i'm unlikely automatically restart network interfaces in a
package's postinst (post-installation script).  And, since another
package could also be in the process of updating systemd units, i'm also
unlikely to automatically issue a "systemctl daemon-reload" in postinst.

if you want "systemd daemon-reload" to happen after successful package
installation, that would probably be a job for the package manager
itself (in debian and ubuntu, that's probably apt (or maybe dpkg)), or
for hooks/triggers associated with package management.

If anyone has a robust/reliable solution that's not likely to cause the
kinds of problems i'm concerned about, i'd love to hear it.

      --dkg
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Reuben Martin]

[-- Attachment #1.1: Type: text/plain, Size: 757 bytes --]

On Fri, Nov 2, 2018, 6:06 PM Daniel Kahn Gillmor <dkg@fifthhorseman.net
wrote:

> On Sun 2018-10-21 18:49:19 +0300, Lucian Cristian wrote:
> > is an annoyance to restart it manually, if you are inside the vpn, you
> > can't do it, I thought that there is a restart script at package update..
>
>
>
> If anyone has a robust/reliable solution that's not likely to cause the
> kinds of problems i'm concerned about, i'd love to hear it.
>

All this discussion about service management kinda misses the point. You're
swapping out a kernel module. There will always be risk. Changing service
management procedures won't mitigate that. If you do not have a means to
connect outside of the VPN connection, and the module (or service) fail,
you're SOL.

-Reuben

>

[-- Attachment #1.2: Type: text/html, Size: 1330 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Matthias Urlichs]

On 02.11.18 14:52, Daniel Kahn Gillmor wrote:
> "systemctl daemon-reload" in postinst

Looks like the perfect usecase for a dpkg trigger.

-- 
-- Matthias Urlichs

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Daniel Kahn Gillmor]

On Sat 2018-11-03 12:54:24 +0100, Matthias Urlichs wrote:
> On 02.11.18 14:52, Daniel Kahn Gillmor wrote:
>> "systemctl daemon-reload" in postinst
>
> Looks like the perfect usecase for a dpkg trigger.

it might be a reasonable use case -- it'd be worth talking with the
systemd maintainers in your preferred distribution about that if you
care about it.

     --dkg
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Daniel Kahn Gillmor]

On Fri 2018-11-02 18:27:55 -0500, Reuben Martin wrote:
> All this discussion about service management kinda misses the
> point. You're swapping out a kernel module. There will always be
> risk. Changing service management procedures won't mitigate that. If
> you do not have a means to connect outside of the VPN connection, and
> the module (or service) fail, you're SOL.

I think you're saying that such a migration is complicated,
idiosyncratic, and might fail -- so we should automate it and let the
admin pick up the pieces if it breaks.

I think i agree that it's complicated, idiosyncratic, and might fail --
by my conclusion is that we *shouldn't* automate it on behalf of the
local admin, but rather let them plan their own migration.  *shrug*

Again, if you have a suggestion for how to reduce the risk, i'm all
ears, but i'm not about to encourage automated breakage in the package
management.

        --dkg
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Jason A. Donenfeld]

FWIW, Ubuntu users got confused with reloading the kernel module (let
alone systemd's view of units), so we wound up adding something a bit
strange to the postinst:

https://github.com/EggieCode/wireguard-ppa/blob/master/debian/wireguard-dkms.postinst#L36-L72

Not sure that Debian would want to follow suite with such a thing though...
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Daniel Kahn Gillmor]

On Sun 2018-11-04 16:35:07 +0100, Jason A. Donenfeld wrote:
> FWIW, Ubuntu users got confused with reloading the kernel module (let
> alone systemd's view of units), so we wound up adding something a bit
> strange to the postinst:
>
> https://github.com/EggieCode/wireguard-ppa/blob/master/debian/wireguard-dkms.postinst#L36-L72
>
> Not sure that Debian would want to follow suite with such a thing though...

i like some of the ideas there, but i don't think i'd want it as-is, for
at least a few reasons:

 * the administrator's choice mechanism
  (/etc/wireguard/.reload-module-on-update) is rather idiosyncratic.
  Using a single boolean debconf question is probably a better approach.

 * echoing suggestions to stdout to rmmod/modprobe just before actually
   doing the thing seems like a recipe for it happening twice.  I think
   i wouldn't make that prompt if the administrator has already asked
   the system to do the upgrade.

 * i'm leery of the "systemctl daemon-reload" approach in particular, as
   mentioned above.  if lots of packages did that in their postinst
   they'd be interacting weirdly with each other during a multi-package
   upgrade.

thanks for the pointer though!

   --dkg
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Fabian Grünbichler]

On Mon, Nov 05, 2018 at 01:28:37PM +0700, Daniel Kahn Gillmor wrote:
> On Sun 2018-11-04 16:35:07 +0100, Jason A. Donenfeld wrote:
> > FWIW, Ubuntu users got confused with reloading the kernel module (let
> > alone systemd's view of units), so we wound up adding something a bit
> > strange to the postinst:
> >
> > https://github.com/EggieCode/wireguard-ppa/blob/master/debian/wireguard-dkms.postinst#L36-L72
> >
> > Not sure that Debian would want to follow suite with such a thing though...
> 
> i like some of the ideas there, but i don't think i'd want it as-is, for
> at least a few reasons:
> 
>  * the administrator's choice mechanism
>   (/etc/wireguard/.reload-module-on-update) is rather idiosyncratic.
>   Using a single boolean debconf question is probably a better approach.
> 
>  * echoing suggestions to stdout to rmmod/modprobe just before actually
>    doing the thing seems like a recipe for it happening twice.  I think
>    i wouldn't make that prompt if the administrator has already asked
>    the system to do the upgrade.

Ack.

>  * i'm leery of the "systemctl daemon-reload" approach in particular, as
>    mentioned above.  if lots of packages did that in their postinst
>    they'd be interacting weirdly with each other during a multi-package
>    upgrade.

I don't see how reloading systemd units too often can cause any kind of
interference, and in fact debhelper already does this for both the
'restart in postinst' (default in compat 10+) and the 'stop in prerm,
start in postinst' (default in compat <= 9) mode - unconditionally, on
every upgrade of a package that ships an automatically (re)started unit.

random data point: on this system with 1606 maintscripts in place, 93
have some variant of systemctl daemon-reload in them (and 12 even have
multiple calls in one maintscript). on a server running Stretch, the
ratio is 72/597.

unnecessarily reloading does of course prolong the upgrade itself, but
since we can't easily tell that the unit has been modified, and not
reloading in case it has been makes the restart fail, the tradeoff of
always reloading on upgrade seems reasonable to me.

FWIW, I'd like to see some variant of transparent reloading integrated
into the Debian packages (even if disabled by default).

> thanks for the pointer though!

thanks for your work on wireguard in Debian :)
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Jason A. Donenfeld]

On Mon, Nov 5, 2018 at 7:47 AM Daniel Kahn Gillmor
<dkg@fifthhorseman.net> wrote:
>  * echoing suggestions to stdout to rmmod/modprobe just before actually
>    doing the thing seems like a recipe for it happening twice.  I think
>    i wouldn't make that prompt if the administrator has already asked
>    the system to do the upgrade.

I was just re-reading this and noticed the same. Good point.
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Daniel Kahn Gillmor]

[-- Attachment #1.1: Type: text/plain, Size: 1567 bytes --]

On Mon 2018-11-05 12:27:44 +0100, Fabian Grünbichler wrote:
>>  * i'm leery of the "systemctl daemon-reload" approach in particular, as
>>    mentioned above.  if lots of packages did that in their postinst
>>    they'd be interacting weirdly with each other during a multi-package
>>    upgrade.
>
> I don't see how reloading systemd units too often can cause any kind of
> interference, and in fact debhelper already does this for both the
> 'restart in postinst' (default in compat 10+) and the 'stop in prerm,
> start in postinst' (default in compat <= 9) mode - unconditionally, on
> every upgrade of a package that ships an automatically (re)started unit.
>
> random data point: on this system with 1606 maintscripts in place, 93
> have some variant of systemctl daemon-reload in them (and 12 even have
> multiple calls in one maintscript). on a server running Stretch, the
> ratio is 72/597.

thanks for this analysis, Fabian.  I think you've convinced me that
while it might be a problem, it's at least a much larger problem that we
don't need to solve or avoid in the wireguard packaging specifically :)

> FWIW, I'd like to see some variant of transparent reloading integrated
> into the Debian packages (even if disabled by default).

if you want to propose a postinst that addresses the two other concerns
(i.e. using a debconf question, and not prompting the local admin if the
local package was able to successfuly handle the reload), i'd happily
review it, and include it if it looks good.

all the best,

       --dkg

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Fabian Grünbichler]

On Tue, Nov 06, 2018 at 02:16:56PM +0700, Daniel Kahn Gillmor wrote:
> On Mon 2018-11-05 12:27:44 +0100, Fabian Grünbichler wrote:
> > FWIW, I'd like to see some variant of transparent reloading integrated
> > into the Debian packages (even if disabled by default).
> 
> if you want to propose a postinst that addresses the two other concerns
> (i.e. using a debconf question, and not prompting the local admin if the
> local package was able to successfuly handle the reload), i'd happily
> review it, and include it if it looks good.

if nobody beats me to it, I will - but no time until the weekend. do you
prefer patch here or via BTS or MR on salsa or BTS referencing MR? ;)
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: wireguard dkms systemd

[Daniel Kahn Gillmor]

On Tue 2018-11-06 14:04:43 +0100, Fabian Grünbichler wrote:
> if nobody beats me to it, I will - but no time until the weekend. do you
> prefer patch here or via BTS or MR on salsa or BTS referencing MR? ;)

either way you like is ok with me -- patches or MR on salsa.  but please
do make sure it makes it into the debian BTS, that'll provide a good
record where it needs to be.

thanks, Fabian!

        --dkg
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard