Bug 1043828 - vpn agent fails to remove iptables rule on vpn-site-connection deletion
Summary: vpn agent fails to remove iptables rule on vpn-site-connection deletion
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-neutron
Version: 5.0 (RHEL 7)
Hardware: Unspecified
OS: Unspecified
medium
high
Target Milestone: ---
: 5.0 (RHEL 7)
Assignee: Terry Wilson
QA Contact: Ofer Blaut
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-12-17 10:05 UTC by Rami Vaknin
Modified: 2016-04-26 19:31 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-12-15 13:38:33 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Launchpad 1331839 0 None None None Never
OpenStack gerrit 101039 0 None None None Never

Description Rami Vaknin 2013-12-17 10:05:17 UTC 
Version
=======
rhos 4.0 on rhel 6.5, 2013-12-12.1 puddle.
openswan rpm from: http://download.devel.redhat.com/brewroot/work/tasks/2739/6722739/openswan-2.6.32-27.el6_5.x86_64.rpm

Description
===========
The following warning appears when deleting VPNaaS' vpn-site-connection object:

2013-12-15 13:57:04.274 6899 WARNING neutron.agent.linux.iptables_manager [-] Tried to remove rule that was not there: 'POSTROUTING' u'-s 10.35.214.0/24 -d 10.35.7.0/24 -m policy --dir out --pol ipsec -j ACCEPT ' True False
Comment 3 Terry Wilson 2014-06-16 13:00:23 UTC 
I have reproduced the error. Investigating.
Comment 4 Terry Wilson 2014-06-18 22:12:19 UTC 
Bug occurs because 'top' parameter is passed to add_nat_rule, but not remove_nat_rule, causing the the rule matching to fail.
Comment 5 Ihar Hrachyshka 2015-12-15 13:38:33 UTC 
This bug was closed as part of a backlog clean up. If you see value in tracking this bug please re-open it.
Note You need to log in before you can comment on or make changes to this bug.