vpn service can't be active again if the openswan process crash

[MingShuang Xian]

We are using VPNaaS with OpenSwan on Ubuntu and found that the OpenSwan will crash when it receives some kinds of IKE2 attack packets. But I'm not very sure the format of the packet. After the OpenSwan crash, VPN-agent can't bring up it again and the VPN service status will be alway DOWN.

We could use following steps to reproduce it.
1. Bring up a VPN connection and show the VPN service status
vpn-service-list
+--------------------------------------+------+--------------------------------------+--------+
| id | name | router_id | status |
+--------------------------------------+------+--------------------------------------+--------+
| c354e5d7-aa81-44c0-9aa7-0f157a2c7b7d | s1 | dde4af28-31ff-4dff-bff9-8355998c5d0c | ACTIVE |
| daa15ef8-3e99-4e37-a839-18dcf7910f9d | s2 | 0e8fb378-3e25-493c-9610-e48025b640ba | ACTIVE |
+--------------------------------------+------+--------------------------------------+--------+

2. Kill the OpenSwan process

3. Show the VPN service status again
vpn-service-list
+--------------------------------------+------+--------------------------------------+--------+
| id | name | router_id | status |
+--------------------------------------+------+--------------------------------------+--------+
| c354e5d7-aa81-44c0-9aa7-0f157a2c7b7d | s1 | dde4af28-31ff-4dff-bff9-8355998c5d0c | DOWN |
| daa15ef8-3e99-4e37-a839-18dcf7910f9d | s2 | 0e8fb378-3e25-493c-9610-e48025b640ba | ACTIVE |
+--------------------------------------+------+--------------------------------------+--------+

The VPN service will keep DOWN until the VPN-agent is restarted.

So we expect the VPN-agent can bring the OpenSwan process again if it crashed.

We found this issue with vpnaas-agent master

[MingShuang Xian (xianms)]

I should submit this defect in neutron-vpnaas project. So I change its status to invalid

[Al Miller (al-miller)]

The OpenSwan pluto process does not automatically restart after crashing, and the VPNaaS connections will go down and stay down until it is restarted. If it is not automatically monitored and restarted, this will be the result.

[Armando Migliaccio (armando-migliaccio)]

http://lists.openstack.org/pipermail/openstack-dev/2016-November/107384.html