[VPNaas] Libreswan driver support in VPNaaS

[venkata anil]

I am running devstack on Fedora. VPNaas is not working on Fedora/centos devstack.

"neutron ipsec-site-connection-create" command is failing

q-vpn log -
Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-250faac2-167b-4861-9d0c-b5710bf02ee2', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/250faac2-167b-4861-9d0c-b5710bf02ee2/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/250faac2-167b-4861-9d0c-b5710bf02ee2/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/250faac2-167b-4861-9d0c-b5710bf02ee2/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24', '--stderrlog']

FATAL: NSS readonly initialization ("/opt/stack/data/neutron/ipsec/250faac2-167b-4861-9d0c-b5710bf02ee2/etc") failed (err -8015)

Because of this error, pluto daemon is not running.
So VPNaas is not working on Fedora/centos devstack.

Fedora/centos uses Libreswan for ipsec.

From the wiki - "Libreswan is a fork of the Openswan IPSEC VPN implementation created by almost all of the openswan developers after a lawsuit about the ownership of the Openswan name was filed against Paul Wouters, then release manager of Openswan, in December 2012."

[venkata anil (anil-venkata)]

Libreswan will be compiled with NSS by default.
when 'ipsec pluto' is called, it checks for NSS db. If NSS db is not initialised, it fails.
So VPNaaS should create NSS db before calling ipsec pluto(for Libreswan implementation) .

ipsec initnss /opt/stack/data/neutron/ipsec/250faac2-167b-4861-9d0c-b5710bf02ee2/etc/pki/nssdb/

then run pluto by specifying this etc/pki/nssdb/ as --ipsecdir
ipsec pluto --ipsecdir /opt/stack/data/neutron/ipsec/250faac2-167b-4861-9d0c-b5710bf02ee2/etc/pki/nssdb

[Paul Michali (pcm)]

Openstack supports OpenSwan specifically, and I don't think there has been much checking at all with Libreswan (and with Fedora for that matter). I can suggest two things...

1) A Libreswan driver could be developed that would do the different provisioning needed for IPsec connections. It could be a subclass of the OpenSwan driver.

2) Adapt the newly added StrongSwan driver, to work under Fedora. This driver has been added in Kilo, with support under Ubuntu, but some modifications are needed for running this under Fedora. There is a bug for that (https://bugs.launchpad.net/neutron/+bug/1441788).

[venkata anil (anil-venkata)]

Thanks Paul.

Both 1 and 2 are needed.

As Fedora supports both stronswan and openswan(Libreswan version)
So for openstack running on fedora, if user wanted to run openswan, Libreswan driver in neutron VPNaaS will be selected. I will try this(your suggestion 1) for this patch.
Openstack running on Fedora, if user wanted strongswan, your other bug((https://bugs.launchpad.net/neutron/+bug/1441788) will take care of that.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/174299

[Paul Michali (pcm)]

Just to cross reference, bug 1444776 and 1441788 address adding StrongSwan support for Fedora (item #2 mentioned in post 2).

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/174299
Committed: https://git.openstack.org/cgit/openstack/neutron-vpnaas/commit/?id=72e1f670fdca2138aa85703cb96eac473f6fb811
Submitter: Jenkins
Branch: master

commit 72e1f670fdca2138aa85703cb96eac473f6fb811
Author: venkata anil <email address hidden>
Date: Sun May 3 10:27:12 2015 +0000

    Libreswan driver support in VPNaaS

    VPNaas is not working on Fedora/centos devstack.
    Fedora/centos uses Libreswan(fork of the Openswan IPSEC VPN) for ipsec.

    Libreswan needs nssdb to be initialised before
    'ipsec pluto' command, otherwise pluto daemon will fail to run

    Change-Id: I54558208b2aaa82bda09c0db96042d236eceba69
    Closes-bug: #1444017

[Wei Hu (huwei-xtu)]

I think this driver should back port to kilo branch. Since in rhel7, there is no available vpnaas driver now. As far as I have tested, only this driver and fedorastrongswan driver can support rhel7 in kilo.

[venkata anil (anil-venkata)]

sure, I will do that now, Thanks Wei Hu.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/185519

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/185519
Committed: https://git.openstack.org/cgit/openstack/neutron-vpnaas/commit/?id=5cc06138332a06334fa1d4fa28e71c59d58f8aca
Submitter: Jenkins
Branch: stable/kilo

commit 5cc06138332a06334fa1d4fa28e71c59d58f8aca
Author: venkata anil <email address hidden>
Date: Sun May 3 10:27:12 2015 +0000

    Libreswan driver support in VPNaaS

    VPNaas is not working on Fedora/centos devstack.
    Fedora/centos uses Libreswan(fork of the Openswan IPSEC VPN) for ipsec.

    Libreswan needs nssdb to be initialised before
    'ipsec pluto' command, otherwise pluto daemon will fail to run

    (cherry picked from commit 72e1f670fdca2138aa85703cb96eac473f6fb811)
    Change-Id: I54558208b2aaa82bda09c0db96042d236eceba69
    Closes-bug: #1444017
    Resolves rhbz: 1213148
    Upstream-Liberty: https://review.openstack.org/#/c/174299/