Bug 1043828

Summary: vpn agent fails to remove iptables rule on vpn-site-connection deletion
Product: Red Hat OpenStack Reporter: Rami Vaknin <rvaknin>
Component: openstack-neutronAssignee: Terry Wilson <twilson>
Status: CLOSED WONTFIX QA Contact: Ofer Blaut <oblaut>
Severity: high Docs Contact:
Priority: medium    
Version: 5.0 (RHEL 7)CC: chrisw, ihrachys, lpeer, nyechiel, oblaut, yeylon
Target Milestone: ---Keywords: ZStream
Target Release: 5.0 (RHEL 7)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-12-15 13:38:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Rami Vaknin 2013-12-17 10:05:17 UTC 
Version
=======
rhos 4.0 on rhel 6.5, 2013-12-12.1 puddle.
openswan rpm from: http://download.devel.redhat.com/brewroot/work/tasks/2739/6722739/openswan-2.6.32-27.el6_5.x86_64.rpm

Description
===========
The following warning appears when deleting VPNaaS' vpn-site-connection object:

2013-12-15 13:57:04.274 6899 WARNING neutron.agent.linux.iptables_manager [-] Tried to remove rule that was not there: 'POSTROUTING' u'-s 10.35.214.0/24 -d 10.35.7.0/24 -m policy --dir out --pol ipsec -j ACCEPT ' True False
Comment 3 Terry Wilson 2014-06-16 13:00:23 UTC 
I have reproduced the error. Investigating.
Comment 4 Terry Wilson 2014-06-18 22:12:19 UTC 
Bug occurs because 'top' parameter is passed to add_nat_rule, but not remove_nat_rule, causing the the rule matching to fail.
Comment 5 Ihar Hrachyshka 2015-12-15 13:38:33 UTC 
This bug was closed as part of a backlog clean up. If you see value in tracking this bug please re-open it.