yahoo-eng-team team mailing list archive

[OpenStack Infra <1711456@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://review.openstack.org/547347
Committed: https://git.openstack.org/cgit/openstack/neutron-vpnaas/commit/?id=b6c8ea8a3cca39bb4138bc7063569352faeb612f
Submitter: Zuul
Branch:    master

commit b6c8ea8a3cca39bb4138bc7063569352faeb612f
Author: Hunt Xu <mhuntxu@xxxxxxxxx>
Date:   Tue Mar 20 17:52:55 2018 +0800

    Make libreswan driver work with recent versions
    
    LibreSwan 3.19 introduces a new commandline argument '--nssdir' for
    pluto which defaults to '/etc/ipsec.d'. As older versions don't
    understand such an option, we cannot just add it to the commandline.
    
    The commandline arguments of LibreSwan are not stable enough to rely on.
    For example, in 3.19, 'ipsec initnss' has the new argument '--nssdir',
    and in 3.20, 'ipsec pluto' also gets this new argument '--nssdir', then
    in 3.22, the argument '--ctlbase' is phased out.
    
    In this commit, instead of trying new options and then fallback to old
    ones for older versions, the bind-mount method used in StrongSwan driver
    is adopted. With /etc and /var/run bind mounted, all the commandline
    arguments related to configuration file places can be removed. This
    ensures that changes of such arguments between different versions won't
    bother as the default places are always used.
    
    This commit also replaces 'auth=' by 'phase2=' in the configuration
    template as the former is for a long time an alias of the latter and
    removed in LibreSwan 3.19.
    
    The virtual-private argument of 'ipsec pluto' has been put into the
    configuration file to avoid commas(,) in the commandline so that the
    netns_wrapper can work well.
    
    A new tempest job for running LibreSwan as the device driver on CentOS 7
    is also added to avoid regression.
    
    This commit has been simply tested on CentOS 7.4 with the following
    versions of LibreSwan provided by the CentOS repo:
    
      - libreswan-3.12-5.el7.x86_64.rpm
      - libreswan-3.12-10.1.el7_1.x86_64.rpm
      - libreswan-3.15-5.el7_1.x86_64.rpm
      - libreswan-3.15-8.el7.x86_64.rpm
      - libreswan-3.20-3.el7.x86_64.rpm
      - libreswan-3.20-5.el7_4.x86_64.rpm
    
    and different versions of LibreSwan provided by libreswan.org[1]:
    
    [1] https://download.libreswan.org/binaries/rhel/7/x86_64/
    
    Change-Id: Iacb6f13187b49cf771f0c24662d6af9217c211b8
    Closes-Bug: #1711456


** Changed in: neutron
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1711456

Title:
  libreswan ipsec driver doesn't work with libreswan versions 3.19+

Status in neutron:
  Fix Released

Bug description:
  VPNaaS agent on RHEL and derivatives uses libreswan as the OpenSwan
  replacement.

  This integration of the VPN agent with libreswan is handled by
  https://github.com/openstack/neutron-
  vpnaas/blob/master/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py

  On the Jan 15, 2017 libreswan team released version 3.19 that
  introduced a change that requires to specify an additional flag for
  NSS DB location if it differs from a default one. Obviously this is an
  issue for VPNaaS because the libreswan_ipsec.py still uses the old
  invocation scheme and this results in the following:

  2017-08-17 16:28:41.000 76497 ERROR neutron.agent.linux.utils [req-
  9c23f077-b34c-42d4-adf4-9ff7f3fd3d19 f618a7405223411ea009e40de67f2791
  66500ca68c4042f5b7d5f372cac3e7db - - -] Exit code: 1; Stdin: ; Stdout:
  ; Stderr: usage: ipsec initnss [--nssdir /etc/ipsec.d]

  2017-08-17 16:28:41.007 76497 ERROR neutron.agent.linux.utils [req-
  9c23f077-b34c-42d4-adf4-9ff7f3fd3d19 f618a7405223411ea009e40de67f2791
  66500ca68c4042f5b7d5f372cac3e7db - - -] Exit code: 1; Stdin: ; Stdout:
  ; Stderr: usage: ipsec initnss [--nssdir /etc/ipsec.d]

  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec [req-9c23f077-b34c-42d4-adf4-9ff7f3fd3d19 f618a7405223411ea009e40de67f2791 66500ca68c4042f5b7d5f372cac3e7db - - -] Failed to enable vpn process on router 376e79e2-51c0-4907-85b3-4ec9af2b0c11
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec Traceback (most recent call last):
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec   File "/usr/lib/python2.7/site-packages/neutron_vpnaas/services/vpn/device_drivers/ipsec.py", line 304, in enable
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec     self.ensure_configs()
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec   File "/usr/lib/python2.7/site-packages/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py", line 61, in ensure_configs
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec     self._execute([self.binary, 'initnss', self.etc_dir])
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec   File "/usr/lib/python2.7/site-packages/neutron_vpnaas/services/vpn/device_drivers/ipsec.py", line 411, in _execute
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec     extra_ok_codes=extra_ok_codes)
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec   File "/usr/lib/python2.7/site-packages/neutron/agent/linux/ip_lib.py", line 912, in execute
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec     log_fail_as_error=log_fail_as_error, **kwargs)
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec   File "/usr/lib/python2.7/site-packages/neutron/agent/linux/utils.py", line 148, in execute
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec     raise ProcessExecutionError(msg, returncode=returncode)
  2017-08-17 16:28:41.007 76497 ERROR neutron_vpnaas.services.vpn.device_drivers.ipsec ProcessExecutionError: Exit code: 1; Stdin: ; Stdout: ; Stderr: usage: ipsec initnss [--nssdir /etc/ipsec.d]

  This issue can be easily solved by adding the --nssdir option in lines
  59 and 61 of https://github.com/openstack/neutron-
  vpnaas/blob/master/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py

  Like this:

          try:
  ---               self._execute([self.binary, 'checknss', self.etc_dir])
  +++            self._execute([self.binary, 'checknss', '--nssdir', self.etc_dir])
          except RuntimeError:
  ---               self._execute([self.binary, 'initnss', self.etc_dir])
  +++            self._execute([self.binary, 'initnss', '--nssdir', self.etc_dir])

  After the change:

  2017-08-17 22:53:25.734 863363 DEBUG neutron.agent.linux.utils [-] Running command (rootwrap daemon): ['ip', 'netns', 'exec', 'snat-376e79e2-51c0-4907-85b3-4ec9af2b0c11', 'ipsec', 'checknss
  ', '--nssdir', '/var/lib/neutron/ipsec/376e79e2-51c0-4907-85b3-4ec9af2b0c11/etc'] execute_rootwrap_daemon /usr/lib/python2.7/site-packages/neutron/agent/linux/utils.py:105
  2017-08-17 22:53:25.741 863363 DEBUG neutron.agent.linux.utils [-] Exit code: 0 execute /usr/lib/python2.7/site-packages/neutron/agent/linux/utils.py:150

  I propose to commit this fix to the
  neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py

  Alternatively, the code can be changed to include the version check of
  libreswan, so that the ipsec nssdb calls could retain backward
  compatibility and the possibility to backport this fix.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1711456/+subscriptions