Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-18133

[OVN] ipsec disable fails to remove all connections

XMLWordPrintable

    • Moderate
    • No
    • False
    • Hide

      None

      Show
      None

      Description of problem:

      after disabling ovn-ipsec at runtime not all the IPsec connections are removed

      ERROR: "ovn-810f13-0-out-1" #14: kernel: xfrm XFRM_MSG_DELPOLICYdelete(UNUSED) response for flow (in): No such file or directory (errno 2)
      

      Version-Release number of selected component (if applicable):

      4.13.0-0.ci.test-2023-08-24-231926-ci-ln-69yhlt2-latest
      
      

      How reproducible:

      Twice

      Steps to Reproduce:

      1. Enable IPsec 
      2. oc patch networks.operator.openshift.io cluster --type=merge -p '{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"ipsecConfig":{ }}}}}'
      3. Disable IPsec
      4. oc patch networks.operator.openshift.io/cluster --type=json -p='[{"op":"remove", "path":"/spec/defaultNetwork/ovnKubernetesConfig/ipsecConfig"}]'
      
      

      Actual results:

      sh-5.1# ovs-appctl -t ovs-monitor-ipsec ipsec/status
      {'ovn-810f13-0': {'ovn-810f13-0-out-1': '000 #279: "ovn-810f13-0-out-1":500 STATE_V2_PARENT_I1 (sent IKE_SA_INIT request); RETRANSMIT in 8s; idle;'}}
      sh-5.1# ovs-appctl -t ovs-monitor-ipsec tunnels/show
      No tunnels configured with IPsec
      
      
      000 Connection list:
      000
      000 "ovn-810f13-0-out-1": 10.243.64.4/32:UDP/0-65535===10.243.64.4[@14213d0b-e67a-4c38-a3f7-f0ff61c4a8b8]...10.243.1.5[@810f135f-da42-4e2c-b0ba-fb4202e2277b]===10.243.1.5/32:UDP/6081; erouted HOLD; eroute owner: #0
      000 "ovn-810f13-0-out-1":     oriented; my_ip=unset; their_ip=unset; mycert=ovs_certkey_14213d0b-e67a-4c38-a3f7-f0ff61c4a8b8; my_updown=ipsec _updown;
      000 "ovn-810f13-0-out-1":   xauth us:none, xauth them:none,  my_username=[any]; their_username=[any]
      000 "ovn-810f13-0-out-1":   our auth:rsasig, their auth:rsasig, our autheap:none, their autheap:none;
      000 "ovn-810f13-0-out-1":   modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, cat:unset;
      000 "ovn-810f13-0-out-1":   sec_label:unset;
      000 "ovn-810f13-0-out-1":   CAs: 'CN=openshift-ovn-kubernetes_signer-ca@1692925275'...'CN=openshift-ovn-kubernetes_signer-ca@1692925275'
      000 "ovn-810f13-0-out-1":   ike_life: 28800s; ipsec_life: 28800s; replay_window: 128; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
      000 "ovn-810f13-0-out-1":   retransmit-interval: 500ms; retransmit-timeout: 60s; iketcp:no; iketcp-port:4500;
      000 "ovn-810f13-0-out-1":   initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
      000 "ovn-810f13-0-out-1":   policy: IKEv2+RSASIG+ECDSA+ENCRYPT+PFS+UP+IKE_FRAG_ALLOW+ESN_NO+ESN_YES+RSASIG_v1_5;
      000 "ovn-810f13-0-out-1":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512;
      000 "ovn-810f13-0-out-1":   conn_prio: 32,32; interface: br-ex; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
      000 "ovn-810f13-0-out-1":   nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
      000 "ovn-810f13-0-out-1":   our idtype: ID_FQDN; our id=@14213d0b-e67a-4c38-a3f7-f0ff61c4a8b8; their idtype: ID_FQDN; their id=@810f135f-da42-4e2c-b0ba-fb4202e2277b
      000 "ovn-810f13-0-out-1":   dpd: action:hold; delay:0; timeout:0; nat-t: encaps:yes; nat_keepalive:yes; ikev1_natt:both
      000 "ovn-810f13-0-out-1":   newest ISAKMP SA: #0; newest IPsec SA: #0; conn serial: $6;
      000 "ovn-810f13-0-out-1":   IKE algorithms: AES_GCM_16_256-HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31
      000 "ovn-810f13-0-out-1":   ESP algorithms: AES_GCM_16_256-NONE
      000
      000 Total IPsec connections: loaded 1, active 0
      000
      000 State Information: DDoS cookies not required, Accepting new IKE connections
      000 IKE SAs: total(1), half-open(1), open(0), authenticated(0), anonymous(0)
      000 IPsec SAs: total(0), authenticated(0), anonymous(0)
      000
      000 #279: "ovn-810f13-0-out-1":500 STATE_V2_PARENT_I1 (sent IKE_SA_INIT request); RETRANSMIT in 14s; idle;
      000 #279: pending CHILD SA for "ovn-810f13-0-out-1"
      000
      

      Expected results:

      sh-5.1# ovs-appctl -t ovs-monitor-ipsec ipsec/status
      {}
      sh-5.1# ovs-appctl -t ovs-monitor-ipsec tunnels/show
      No tunnels configured with IPsec
      
      
      

      Additional info:

            pepalani@redhat.com Periyasamy Palanichamy
            rbrattai@redhat.com Ross Brattain
            Anurag Saxena Anurag Saxena
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: