github-actions[bot] commented on issue #14545: URL: https://github.com/apache/cloudstack/issues/14545#issuecomment-6580446614
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/41453262605) for details. > > </details> ## 🎯 Triage report Since 4.22.1.0, `configure_l2tpIpsec()` in the VR config empties the secrets file before rewriting it. `CsFile.empty()` clears the on-disk copy too, so the file always reads as changed. Combined with the restart-on-change logic from #12422, every iptables pass restarts xl2tpd and drops all VPN sessions. The reporter's proposed fix is to use `secret.repopulate()` instead of `secret.empty()`, which keeps the disk copy for comparison. ### 📊 Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:bug | Unintended disconnects after a change in 4.22.1+ (regression) | | **Component** | component:virtual-router | Bug is in `configure.py` / `CsFile.py` on the VR | | **Severity** | Severity:Major | All VPN users on the router drop on any rule change; no data loss reported | | **Labels** | type:bug, component:virtual-router, component:vpc, Severity:Major | | | **Coding agent** | Suitable | Specific root cause and one-line fix direction with line references; scope is self-contained | ### 🔗 Similar issues - #12195 (related, closed) — VPN setting changes not propagated to the VR; the #12422 fix for it introduced the restart-on-change behaviour - #7282 (related) — remote access VPN cannot connect <details> <summary>💡 Notes and suggestions</summary> - Reproduction: VPC with remote access VPN and a connected L2TP client; add or delete an LB or ACL rule and watch `cloud.log` on the VR for `systemctl restart xl2tpd`. - Verify that a changed PSK still restarts xl2tpd after the fix. - Probably worth a regression test in the VR config tests. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/41453262605) · copilot · haiku55 · \~2 AIC · ⊞ 3.8K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 41453262605, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/41453262605 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"41453262605","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/41453262605","publishing_job":{"key":"safe_outputs","check_run_id":"125350399070"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
