Repository navigation
VR: don't restart xl2tpd when the remote access VPN config is unchanged - #14546
Open
willbennett-devops wants to merge 1 commit into
Open
willbennett-devops wants to merge 1 commit into
willbennett-devops wants to merge 1 commit into
Conversation
configure_l2tpIpsec() called secret.empty() before rewriting ipsec.any.secrets. empty() also clears the copy read from disk, so the file always compared as changed, and since apache#12422 every iptables pass restarted xl2tpd and dropped all remote access VPN sessions on any LB, ACL, port forward or firewall change. Use repopulate(), which keeps the loaded copy, so xl2tpd is restarted only when the PSK or the L2TP configuration really changed.
|
Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes a regression from #12422 where every iptables pass on a router (LB, ACL, port forward, firewall, static
NAT, site-to-site changes) restarts xl2tpd and disconnects every remote access VPN client.
configure_l2tpIpsec()calledsecret.empty()on theipsec.any.secretsCsFile before adding the PSK line.empty()also clears the copy loaded from disk, so the file always compared as changed, and since #12422 a changed file means
systemctl restart xl2tpd. The fix usesrepopulate(), which keeps the loaded copy, so xl2tpd is only restarted whenthe PSK or another L2TP setting really changes.
Fixes: #14545
Types of changes
Feature/Enhancement Scale or Bug Severity
Bug Severity
How Has This Been Tested?
Unit tests: new
systemvm/test/TestCsRemoteAccessVpn.pyrunsconfigure_l2tpIpsec()against files in a temporarydirectory. A second pass with the same config returns False (it returns True without this change), and a changed PSK
returns True and rewrites the secrets file.
On a 4.23.0.0 KVM lab (the changed function is identical in 4.22 and main), with the patched
configure.pyon bothrouters of a redundant VPC and an L2TP/IPsec client connected with a continuous ping:
cloud.logshows "Nothing to commit. The/etc/ipsec.d/ipsec.any.secrets file did not change" on every pass, no xl2tpd restart, the session and the ping
held throughout.
and behaved the same.
How did you try to break this feature and the system with this change?
Changed the PSK to make sure a real change is still written and still restarts xl2tpd (unit test).
repopulate()already exists in
CsFileand is used the same way for the site-to-site config inconfigure.py.