Merge ~enr0n/ubuntu/+source/strongswan:lp2119652 into ubuntu/+source/strongswan:ubuntu/devel

[Nick Rosbrook]

Workaround for LP: #2119652

[Nick Rosbrook (enr0n)]

I have tested this in a local autopkgtest setup, but have not taken the full PPA build/test trip.

[Lukas Märdian (slyon)]

Thanks a lot Nick!

This LGTM and is passing dep8 tests locally:

$ autopkgtest -U -B . --test-name=host-to-host --apt-pocket=proposed=src:systemd -- qemu -- /data/autopkgtest-questing-amd64.img
[...]
autopkgtest [16:34:38]: test host-to-host: [-----------------------
2025-08-19T16:34:45+02:00 INFO Waiting for automatic snapd restart...
lxd (5.21/stable) 5.21.3-c5ae129 from Canonical** installed
plugin 'aesni': failed to load - aesni_plugin_create not found and no plugin file available
plugin 'sshkey': failed to load - sshkey_plugin_create not found and no plugin file available
Creating a CA

Generating private key for CA
Generating self-signed certificate for CA
plugin 'aesni': failed to load - aesni_plugin_create not found and no plugin file available
plugin 'sshkey': failed to load - sshkey_plugin_create not found and no plugin file available
Here is the CA cert:
plugin 'aesni': failed to load - aesni_plugin_create not found and no plugin file available
plugin 'sshkey': failed to load - sshkey_plugin_create not found and no plugin file available
  subject: "C=CH, O=strongSwan, CN=strongSwan Root CA"
  issuer: "C=CH, O=strongSwan, CN=strongSwan Root CA"
  validity: not before Aug 19 16:35:16 2025, ok
             not after Aug 29 16:35:16 2025, ok (expires in 9 days)
  serial: 50:02:06:3e:88:28:5a:04
  flags: CA CRLSign self-signed
  subjkeyId: ce:ec:18:8c:49:87:5d:c7:c5:5d:ef:c6:51:89:2e:52:f2:2b:97:2a
  pubkey: ED25519 256 bits
  keyid: 05:f6:19:40:f0:21:a5:11:e7:d9:f9:ce:05:28:42:9e:2f:29:43:e6
  subjkey: ce:ec:18:8c:49:87:5d:c7:c5:5d:ef:c6:51:89:2e:52:f2:2b:97:2a
Generating key and certificate for peer moon
plugin 'aesni': failed to load - aesni_plugin_create not found and no plugin file available
plugin 'sshkey': failed to load - sshkey_plugin_create not found and no plugin file available
plugin 'aesni': failed to load - aesni_plugin_create not found and no plugin file available
plugin 'sshkey': failed to load - sshkey_plugin_create not found and no plugin file available
plugin 'aesni': failed to load - aesni_plugin_create not found and no plugin file available
plugin 'sshkey': failed to load - sshkey_plugin_create not found and no plugin file available
Generating key and certificate for peer sun
plugin 'aesni': failed to load - aesni_plugin_create not found and no plugin file available
plugin 'sshkey': failed to load - sshkey_plugin_create not found and no plugin file available
plugin 'aesni': failed to load - aesni_plugin_create not found and no plugin file available
plugin 'sshkey': failed to load - sshkey_plugin_create not found and no plugin file available
plugin 'aesni': failed to load - aesni_plugin_create not found and no plugin file available
plugin 'sshkey': failed to load - sshkey_plugin_create not found and no plugin file available
Setting up host LXD
qemu-system-x86_64: Slirp: external icmpv6 not supported yet
To start your first container, try: lxc launch ubuntu:24.04
Or for a virtual machine: lxc launch ubuntu:24.04 --vm

Creating host containers
Launching container moon with release questing
Waiting for container moon to be ready .....Connection to 10.73.22.38 22 port [tcp/ssh] succeeded!

Copying ...

review: Approve

[Nick Rosbrook (enr0n)]

Thanks for reviewing this! I have uploaded it.

diff --git a/debian/changelog b/debian/changelog
index 8eea4cf..59c83bf 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+strongswan (6.0.1-6ubuntu3) questing; urgency=medium
+
+  * d/t/host-to-host: disable DNSSEC in container during test (LP: #2119652)
+
+ -- Nick Rosbrook <[e-mail]>  Tue, 19 Aug 2025 10:26:51 -0400
+
 strongswan (6.0.1-6ubuntu2) questing; urgency=medium
 
   * Cherry-pick upstream commits to fix FTBFS with GCC-15 C23.
diff --git a/debian/tests/host-to-host b/debian/tests/host-to-host
index 3a76da0..dcb502b 100755
--- a/debian/tests/host-to-host
+++ b/debian/tests/host-to-host
@@ -230,6 +230,7 @@ _setup_lxd() {
 _setup_host_containers() {
     local release
     local ip
+    local iface
     local -i result=0
     local -a deps
 
@@ -242,6 +243,19 @@ _setup_host_containers() {
         echo -en "Waiting for container ${container} to be ready "
         wait_container_ready "${container}"
 
+
+        # With DNSSEC=allow-downgrade enabled by default in systemd-resolved,
+        # name resolution on the lxd domain fails because the resolver on
+        # lxdbr0 is not configured for DNSSEC. As a workaround, disable DNSSEC
+        # on the container's interfaces during the test (LP: #2119652).
+        iface=$(lxc list --columns=4 --format=csv "${container}" | awk -F'[()]' '{print $2}')
+        output=$(lxc exec "${container}" resolvectl dnssec "${iface}" no ) || {
+            result=$?
+            echo "Failed to disable systemd-resolved DNSSEC on interface ${iface} in container ${container}"
+            echo "${output}"
+            return ${result}
+        }
+
         echo "Copying over /etc/apt to container ${container}"
         lxc exec "${container}" -- rm -rf /etc/apt
         lxc exec "${container}" -- mkdir -p /etc/apt