willbennett-devops opened a new pull request, #14546:
URL: https://github.com/apache/cloudstack/pull/14546
### Description
This PR fixes a regression from #12422 where every iptables pass on a router
(LB, ACL, port forward, firewall, static
NAT, site-to-site changes) restarts xl2tpd and disconnects every remote
access VPN client.
`configure_l2tpIpsec()` called `secret.empty()` on the `ipsec.any.secrets`
CsFile before adding the PSK line. `empty()`
also clears the copy loaded from disk, so the file always compared as
changed, and since #12422 a changed file means
`systemctl restart xl2tpd`. The fix uses `repopulate()`, which keeps the
loaded copy, so xl2tpd is only restarted when
the PSK or another L2TP setting really changes.
Fixes: #14545
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Bug Severity
- [ ] BLOCKER
- [ ] Critical
- [x] Major
- [ ] Minor
- [ ] Trivial
### How Has This Been Tested?
Unit tests: new `systemvm/test/TestCsRemoteAccessVpn.py` runs
`configure_l2tpIpsec()` against files in a temporary
directory. A second pass with the same config returns False (it returns True
without this change), and a changed PSK
returns True and rewrites the secrets file.
On a 4.23.0.0 KVM lab (the changed function is identical in 4.22 and main),
with the patched `configure.py` on both
routers of a redundant VPC and an L2TP/IPsec client connected with a
continuous ping:
- LB rule create and delete, and ACL rule add and remove: `cloud.log` shows
"Nothing to commit. The
/etc/ipsec.d/ipsec.any.secrets file did not change" on every pass, no
xl2tpd restart, the session and the ping
held throughout.
- Restart of the VPC with cleanup, with the patched systemvm scripts on the
hosts: the new routers carried the change
and behaved the same.
- VPN deleted and created again (CloudStack generates a new PSK): the client
connected with the new key.
#### How did you try to break this feature and the system with this change?
Changed the PSK to make sure a real change is still written and still
restarts xl2tpd (unit test). `repopulate()`
already exists in `CsFile` and is used the same way for the site-to-site
config in `configure.py`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
