Mirantis OpenStack

[Plugins] VPN connection is stuck in 'Active' state even if connection isn't established

Bug #1486944 reported by Sergey Kolekonov
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Mirantis OpenStack
Fix Released
High
Elena Ezhova
Mirantis OpenStack 7.0
6.1.x
Won't Fix
High
Elena Ezhova
Mirantis OpenStack 6.1-updates
7.0.x
Won't Fix
High
Elena Ezhova
Mirantis OpenStack 7.0-updates
8.0.x
Fix Released
High
Elena Ezhova
Mirantis OpenStack 8.0

Bug Description

VPN connection is stuck in 'Active' state even if connection is broken.

Steps to reproduce:
- deploy an environment with VPNaaS plugin (7.0-compatible, under development) - 3 controllers + 1 compute node
- create additional network, subnet and router
- create VPN connections between the default network (net04) and the new one
- spawn 2 vms, check that vpn connection works correctly
- remove 1 vpn connection

Expected result:
The second connection is in 'Down' state

Actual result:
The second connection is still 'Active', though it's incorrect

Diagnostic snapshot is very big (400 Mb), I'll give it on demand

Tags: area-neutron
Sergey Kolekonov (skolekonov)
summary: - VPN connection is stuck in 'Active' state even if connection isn't
- established
+ [Plugins] VPN connection is stuck in 'Active' state even if connection
+ isn't established
Revision history for this message
Elena Ezhova (eezhova) wrote :

This can be reproduced on devstack with neutron-vpnaas master. Reported a bug in upstream: https://bugs.launchpad.net/neutron/+bug/1487003

Changed in mos:
assignee: MOS Neutron (mos-neutron) → Elena Ezhova (eezhova)
status: New → Confirmed
Alexander Ignatov (aignatov)
Changed in mos:
status: Confirmed → In Progress
Revision history for this message
Alexander Ignatov (aignatov) wrote :

Make it as Won't fix since Mediums don't fix at current release stage. Moved this bug to 8.0

Revision history for this message
Alexander Ignatov (aignatov) wrote :

Won't fix for updates branches but for 8.0 it's ok to merge patch

Revision history for this message
Fuel Devops McRobotson (fuel-devops-robot) wrote : Fix proposed to openstack/neutron-vpnaas (openstack-ci/fuel-8.0/liberty)

Fix proposed to branch: openstack-ci/fuel-8.0/liberty
Change author: Elena Ezhova <email address hidden>
Review: https://review.fuel-infra.org/13887

Revision history for this message
Fuel Devops McRobotson (fuel-devops-robot) wrote : Fix merged to openstack/neutron-vpnaas (openstack-ci/fuel-8.0/liberty)

Reviewed: https://review.fuel-infra.org/13887
Submitter: Pkgs Jenkins <email address hidden>
Branch: openstack-ci/fuel-8.0/liberty

Commit: ef7ff49332c05b1dfad1f5e08e89f3874324ed3d
Author: Elena Ezhova <email address hidden>
Date: Thu Nov 12 14:15:08 2015

Set IPSec site connection Down if peer doesn't respond

If OpenSwan or LibreSwan driver is used then when one of the peer
connections goes down by any reason the second connection remains
in 'Active' state, though it is incorrect. StrongSwan driver
doesn't have such problem.

This change modifies ipsec site connection status check for
OpenSwan and LibreSwan drivers in the following way:
If a status check shows that a given pluto process is still running,
scan output related to all its connections and mark 'Down' those,
for which there is no established IPSec SA.

Refactored UT so that connection status tests are executed for all
*Swan drivers, which involved changing base class of OpenSwanProcess
tests to IPSecDeviceLegacy.

Conflicts:
 neutron_vpnaas/tests/unit/services/vpn/device_drivers/test_ipsec.py

Cherry-picked from: https://review.openstack.org/#/c/238108
Closes-Bug: #1486944
Change-Id: I699c71a92ec33dd8ccfc31098299d019b11dfe9a

Anastasia Kuznetsova (akuznetsova)
tags: added: neutron
Anastasia Kuznetsova (akuznetsova)
tags: added: area-neutron
removed: neutron
Revision history for this message
Kristina Berezovskaia (kkuznetsova) wrote :

Can't verify this bug on 8-0 env because of impossibility to deploy env with VPNaaS plugin before release. Work for compatibility mos 8.0 and VPNaaS will start after release 8.0. So verified only that code was merged

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.