[IPv6] [VPNaaS] Remove obsolete --defaultroutenexthop for ipsec addconn command

[venkata anil]

To load the connection into pluto daemon, neutron is calling ipsec addconn command.

When ipv6 address is passed for --defaultroutenexthop option, for this command, like below,

'ipsec', 'addconn', '--defaultroutenexthop', u'1001::f816:3eff:feb4:a2db'

we are getting following error
ignoring invalid defaultnexthop: non-ipv6 address may not contain `:'

As --defaultroutenexthop is obsolete(http://ftp.libreswan.org/CHANGES ), we should avoid passing this for ipv6 subnet.

[Paul Michali (pcm)]

I see that it is indicated that the --defaultroutenexthop is obsolete for Libreswan. I guess this was tested on Fedora. Since OpenStack officially supports OpenSwan and not LibreSwan, two things should be done.

First, we should determine whether or not this problem exists for OpenSwan and, if so, fix it under this bug.

Second, a bug should be created for adding LibreSwan support (under Fedora) for OpenStack. The driver can be derived (subclassed) from the OpenSwan driver and can then provide the above fix as well.

In general, IPv6 support by the various VPN device drivers, should be tested/verified.

[venkata anil (anil-venkata)]

Thanks Paul Michali.
This error is seen while running devstack on ubuntu with openswan(and not Libreswan).

we are getting following error
ignoring invalid defaultnexthop: non-ipv6 address may not contain `:'

This is change is mandatory for ipv6 on openswan.

[Paul Michali (pcm)]

Thanks for checking. There is bug 1444017 for adding Libreswan support to Fedora.

We should make sure that this fix is applies to all three drivers (OpenSwan, LibreSwan, StrongSwan).

[Paul Michali (pcm)]

Looks like we need to address this, to be able to support IPv6 for *Swan. Should see if the change is needed on each flavor of Swan.

[Paul Michali (pcm)]

Marked as new, since no one is assigned currently, and it should be verified on each Swan variant.

[Armando Migliaccio (armando-migliaccio)]

This bug is > 240 days without activity. We are unsetting assignee and milestone and setting status to Incomplete in order to allow its expiry in 60 days.

If the bug is still valid, then update the bug status.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]