Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2003664/?format=api
{ "id": 2003664, "url": "http://patchwork.ozlabs.org/api/patches/2003664/?format=api", "web_url": "http://patchwork.ozlabs.org/project/openvswitch/patch/20241029101608.2991596-4-i.maximets@ovn.org/", "project": { "id": 47, "url": "http://patchwork.ozlabs.org/api/projects/47/?format=api", "name": "Open vSwitch", "link_name": "openvswitch", "list_id": "ovs-dev.openvswitch.org", "list_email": "ovs-dev@openvswitch.org", "web_url": "http://openvswitch.org/", "scm_url": "git@github.com:openvswitch/ovs.git", "webscm_url": "https://github.com/openvswitch/ovs", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20241029101608.2991596-4-i.maximets@ovn.org>", "list_archive_url": null, "date": "2024-10-29T10:15:01", "name": "[ovs-dev,3/9] ipsec: libreswan: Try to bring non-active connections up.", "commit_ref": null, "pull_url": null, "state": "changes-requested", "archived": false, "hash": "069cd4d0260557ac3ab3a49c74663dfc6d4938c7", "submitter": { "id": 76798, "url": "http://patchwork.ozlabs.org/api/people/76798/?format=api", "name": "Ilya Maximets", "email": "i.maximets@ovn.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/openvswitch/patch/20241029101608.2991596-4-i.maximets@ovn.org/mbox/", "series": [ { "id": 430270, "url": "http://patchwork.ozlabs.org/api/series/430270/?format=api", "web_url": "http://patchwork.ozlabs.org/project/openvswitch/list/?series=430270", "date": "2024-10-29T10:14:58", "name": "ipsec: Resiliency to Libreswan failures.", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/430270/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2003664/comments/", "check": "fail", "checks": "http://patchwork.ozlabs.org/api/patches/2003664/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<ovs-dev-bounces@openvswitch.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "ovs-dev@openvswitch.org" ], "Delivered-To": [ "patchwork-incoming@legolas.ozlabs.org", "ovs-dev@lists.linuxfoundation.org" ], "Authentication-Results": [ "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=140.211.166.133; helo=smtp2.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)", "smtp1.osuosl.org;\n dmarc=none (p=none dis=none) header.from=ovn.org" ], "Received": [ "from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4Xd5l354QYz1xxC\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 29 Oct 2024 21:16:31 +1100 (AEDT)", "from localhost (localhost [127.0.0.1])\n\tby smtp2.osuosl.org (Postfix) with ESMTP id 1C42140F59;\n\tTue, 29 Oct 2024 10:16:29 +0000 (UTC)", "from smtp2.osuosl.org ([127.0.0.1])\n by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id N1C4KiWckYHE; Tue, 29 Oct 2024 10:16:27 +0000 (UTC)", "from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56])\n\tby smtp2.osuosl.org (Postfix) with ESMTPS id B42D740DEF;\n\tTue, 29 Oct 2024 10:16:27 +0000 (UTC)", "from lf-lists.osuosl.org (localhost [127.0.0.1])\n\tby lists.linuxfoundation.org (Postfix) with ESMTP id 8387BC08A8;\n\tTue, 29 Oct 2024 10:16:27 +0000 (UTC)", "from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138])\n by lists.linuxfoundation.org (Postfix) with ESMTP id 92D54C08A3\n for <ovs-dev@openvswitch.org>; Tue, 29 Oct 2024 10:16:26 +0000 (UTC)", "from localhost (localhost [127.0.0.1])\n by smtp1.osuosl.org (Postfix) with ESMTP id 5D27A80D91\n for <ovs-dev@openvswitch.org>; Tue, 29 Oct 2024 10:16:26 +0000 (UTC)", "from smtp1.osuosl.org ([127.0.0.1])\n by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id AxUl-LgpGR0U for <ovs-dev@openvswitch.org>;\n Tue, 29 Oct 2024 10:16:24 +0000 (UTC)", "from mail-lf1-f67.google.com (mail-lf1-f67.google.com\n [209.85.167.67])\n by smtp1.osuosl.org (Postfix) with ESMTPS id C1C6E80D69\n for <ovs-dev@openvswitch.org>; Tue, 29 Oct 2024 10:16:23 +0000 (UTC)", "by mail-lf1-f67.google.com with SMTP id\n 2adb3069b0e04-539f4d8ef66so6870979e87.1\n for <ovs-dev@openvswitch.org>; Tue, 29 Oct 2024 03:16:23 -0700 (PDT)", "from im-t490s.redhat.com (ip-86-49-44-151.bb.vodafone.cz.\n [86.49.44.151]) by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-431b4594ec3sm20279685e9.1.2024.10.29.03.16.18\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 29 Oct 2024 03:16:19 -0700 (PDT)" ], "X-Virus-Scanned": [ "amavis at osuosl.org", "amavis at osuosl.org" ], "X-Comment": "SPF check N/A for local connections - client-ip=140.211.9.56;\n helo=lists.linuxfoundation.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=<UNKNOWN> ", "DKIM-Filter": [ "OpenDKIM Filter v2.11.0 smtp2.osuosl.org B42D740DEF", "OpenDKIM Filter v2.11.0 smtp1.osuosl.org C1C6E80D69" ], "Received-SPF": "Pass (mailfrom) identity=mailfrom; client-ip=209.85.167.67;\n helo=mail-lf1-f67.google.com; envelope-from=i.maximets.ovn@gmail.com;\n receiver=<UNKNOWN>", "DMARC-Filter": "OpenDMARC Filter v1.4.2 smtp1.osuosl.org C1C6E80D69", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1730196981; x=1730801781;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc\n :subject:date:message-id:reply-to;\n bh=BMOy3Peu9UkbUk73zlOC4DDNp3HINhlNfVwEe3M71SI=;\n b=YRMhI+zEFufWWVEwseAHFC+v8mmBKI3tkiT9BjCHkMr+lXZqEegtq8OasdEQ2lwDrq\n IggQoB66S3d4gbEDdmHJybr6OWp6Nz6ZmAEB/xiy8esnr7WFn9yf1X3nnPtllmfm+iHc\n kmVozbKGl4UGUiG1/1QiPgMKuORrBvLHyp/INJ4zXWyOEQE3yGIcqSq2s0zLspHmcOUH\n B4hCZIfM7Z6gbO0uNe4YsVXUjQ8VLrYrVEYhayYMjv+EodCP1jPhxV9ML18sFkKtyr3F\n ewchpBIE1TDdls7ppQb4DcAOPUdoG4Vs2ZbKh0+xWPMtPYURdED7mYX8NCP1P4H02R2Q\n WWkQ==", "X-Gm-Message-State": "AOJu0YzggqNaFlg17j4PzF4ixc7LiSX+lHZg2ZqsL6P7E5aL/szgKC8r\n JkHBIMeD+zZIKBcFmsFtD7LRpGC7YmJe/Fduj5iKEFvcDak+JaNSrp20AAHC", "X-Google-Smtp-Source": "\n AGHT+IEbbJLjbrAXaSTEwJK8lS9DP0yTsjOf4ZeaTLY2Ci2fUz+lo3wP8Nn3C3a7sgVTce7o8Ad2Iw==", "X-Received": "by 2002:a05:6512:1188:b0:539:fc26:74bd with SMTP id\n 2adb3069b0e04-53b3490ee7dmr4730175e87.27.1730196979570;\n Tue, 29 Oct 2024 03:16:19 -0700 (PDT)", "From": "Ilya Maximets <i.maximets@ovn.org>", "To": "ovs-dev@openvswitch.org", "Date": "Tue, 29 Oct 2024 11:15:01 +0100", "Message-ID": "<20241029101608.2991596-4-i.maximets@ovn.org>", "X-Mailer": "git-send-email 2.46.0", "In-Reply-To": "<20241029101608.2991596-1-i.maximets@ovn.org>", "References": "<20241029101608.2991596-1-i.maximets@ovn.org>", "MIME-Version": "1.0", "Subject": "[ovs-dev] [PATCH 3/9] ipsec: libreswan: Try to bring non-active\n connections up.", "X-BeenThere": "ovs-dev@openvswitch.org", "X-Mailman-Version": "2.1.30", "Precedence": "list", "List-Id": "<ovs-dev.openvswitch.org>", "List-Unsubscribe": "<https://mail.openvswitch.org/mailman/options/ovs-dev>,\n <mailto:ovs-dev-request@openvswitch.org?subject=unsubscribe>", "List-Archive": "<http://mail.openvswitch.org/pipermail/ovs-dev/>", "List-Post": "<mailto:ovs-dev@openvswitch.org>", "List-Help": "<mailto:ovs-dev-request@openvswitch.org?subject=help>", "List-Subscribe": "<https://mail.openvswitch.org/mailman/listinfo/ovs-dev>,\n <mailto:ovs-dev-request@openvswitch.org?subject=subscribe>", "Cc": "Ilya Maximets <i.maximets@ovn.org>", "Content-Type": "text/plain; charset=\"us-ascii\"", "Content-Transfer-Encoding": "7bit", "Errors-To": "ovs-dev-bounces@openvswitch.org", "Sender": "\"dev\" <ovs-dev-bounces@openvswitch.org>" }, "content": "Sometimes connections are getting loaded, but do not become active for\nsome reason on a first try. We can try and bring them up manually.\nHowever, if they are still not active after that, it's better to just\nremove the connection and try to add them from scratch, as there must\nbe some internal issue in libreswan that doesn't allow these connections\nto actually become active.\n\nNote: Once the \"defunct\" connection is removed, the second connection\nfor the same tunnel will also be removed as \"half-loaded\". This ensures\nthat all the shared SAs will also be cleaned up, so we can truly start\nfrom scratch.\n\nSigned-off-by: Ilya Maximets <i.maximets@ovn.org>\n---\n ipsec/ovs-monitor-ipsec.in | 12 ++++++++++++\n 1 file changed, 12 insertions(+)", "diff": "diff --git a/ipsec/ovs-monitor-ipsec.in b/ipsec/ovs-monitor-ipsec.in\nindex 09a29e2ca..d667c08bc 100755\n--- a/ipsec/ovs-monitor-ipsec.in\n+++ b/ipsec/ovs-monitor-ipsec.in\n@@ -514,6 +514,7 @@ conn prevent_unencrypted_vxlan\n self.IPSEC_D = \"sql:\" + libreswan_root_prefix + ipsec_d\n self.IPSEC_CTL = libreswan_root_prefix + ipsec_ctl\n self.conf_file = None\n+ self.conns_not_active = set()\n self.secrets_file = None\n vlog.dbg(\"Using: \" + self.IPSEC)\n vlog.dbg(\"Configuration file: \" + self.IPSEC_CONF)\n@@ -638,6 +639,14 @@ conn prevent_unencrypted_vxlan\n loaded = set(loaded_conns.get(name, dict()).keys())\n active = set(active_conns.get(name, dict()).keys())\n \n+ # Untrack connections that became active.\n+ self.conns_not_active.difference_update(active)\n+ # Remove connections that didn't become active after --start\n+ # and another explicit --up.\n+ for conn in self.conns_not_active & loaded:\n+ self._delete_ipsec_connection(conn, \"is defunct\")\n+ loaded.remove(conn)\n+\n # Remove all the loaded or active but not desired connections.\n for conn in loaded | active:\n if conn not in desired:\n@@ -668,6 +677,8 @@ conn prevent_unencrypted_vxlan\n # so loaded >= active\n for conn in loaded - active:\n vlog.info(\"Bringing up ipsec connection %s\" % conn)\n+ # On failure to --up it will be removed from the set.\n+ self.conns_not_active.add(conn)\n self._start_ipsec_connection(conn, \"up\")\n \n # Update shunt policy if changed\n@@ -797,6 +808,7 @@ conn prevent_unencrypted_vxlan\n \n def _delete_ipsec_connection(self, conn, reason):\n vlog.info(\"%s %s, removing\" % (conn, reason))\n+ self.conns_not_active.discard(conn)\n run_command(self.IPSEC_AUTO +\n [\"--ctlsocket\", self.IPSEC_CTL,\n \"--config\", self.IPSEC_CONF,\n", "prefixes": [ "ovs-dev", "3/9" ] }