Remote access VPN users are disconnected on every LB, ACL, port forward or firewall change (xl2tpd restarted on every iptables pass)

未关闭 适合新手
  • 哪里不对？
#14,545 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@willbennett-devops 已经在做这个了。

开始于 2026年10月31日。

  • #14546 来自 @willbennett-devops —— 未关闭

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
72/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
linux, python
领域
networking

调研方向

从 systemvm/debian/opt/cloud/bin/configure.py 第 1277 行附近的 configure_l2tpIpsec() 开始，那里在重新添加 PSK 之前调用了 secret.empty()，然后阅读 systemvm/debian/opt/cloud/bin/cs/CsFile.py（第 42-56 行）中的 empty()、is_changed() 和 repopulate()。完成标准是：无关的规则变更不再重启 xl2tpd，而已更改的 PSK 仍会触发重启。在这种情况下，请检查 cloud.log 中的重启日志行已经消失。

由索引模型根据 Issue 内容生成。

描述

problem

Since 4.22.1.0, every remote access VPN (L2TP/IPsec) client on a router is disconnected whenever an unrelated rule
changes on that router: creating or deleting an LB rule, an ACL rule, a port forward, a firewall rule, a static NAT or
a site-to-site VPN. The client has to reconnect each time. Some clients (macOS) don't reconnect on their own.

cloud.log on the router shows xl2tpd being restarted on every one of those passes, although none of the L2TP files
changed except the secrets file, which was rewritten with the same content:

Nothing to commit. The /etc/ipsec.d/l2tp.conf file did not change
Wrote edited file /etc/ipsec.d/ipsec.any.secrets
Nothing to commit. The /etc/xl2tpd/xl2tpd.conf file did not change
Nothing to commit. The /etc/ppp/options.xl2tpd file did not change
Executing: ipsec update
Executing: systemctl restart xl2tpd
Executing: ipsec rereadsecrets

Root cause, line numbers from the 4.22 branch (56306ab52c), same code in 4.23.0.0 and main:

  • systemvm/debian/opt/cloud/bin/configure.py:1277, in configure_l2tpIpsec(): secret.empty() before
    secret.addeq(": PSK ...") and secret.commit().
  • systemvm/debian/opt/cloud/bin/cs/CsFile.py:51-53: empty() clears both config (the copy read from disk) and
    new_config. is_changed() (CsFile.py:42-46) compares the two, so after empty() the file always reads as
    changed and commit() always returns True.
  • configure.py:1247-1250: since #12422 (the fix for #12195), a changed config means systemctl restart xl2tpd
    instead of systemctl start xl2tpd. Restarting xl2tpd kills every pppd session.
  • CsRemoteAccessVpn.process() runs from IpTablesExecutor.process() (configure.py:1615-1616), which runs for every
    data bag with process_iptables: True (configure.py:1673-1690), not only for VPN changes.

Before #12422 the same pass ran systemctl start xl2tpd, a no-op on a running service, so the always-changed secrets
file did no harm.

Impact: on 4.22.1.0 and later, any router with a remote access VPN drops all its VPN users on any rule change in the
network or VPC. With CKS, the cloud controller manager's LB and ACL reconciles trigger it too.

versions

4.22.1.0, 4.22.1.1 and 4.23.0.0 (any version containing #12422). Seen on 4.23.0.0 with KVM, VPC with redundant
routers, advanced networking. Not specific to the hypervisor.

The steps to reproduce the bug
  1. Create a VPC, enable remote access VPN on its source NAT IP and add a VPN user.
  2. Connect an L2TP/IPsec client and keep a ping running to a VM in a tier.
  3. Create (or delete) an LB rule, or add an ACL rule, in that VPC.
  4. The client's session drops. cloud.log on the router shows "Wrote edited file /etc/ipsec.d/ipsec.any.secrets"
    followed by systemctl restart xl2tpd.
What to do about it?

Use secret.repopulate() instead of secret.empty() in configure_l2tpIpsec(). repopulate() (CsFile.py:55-56)
clears only new_config and keeps the copy loaded from disk, so an unchanged PSK compares equal and xl2tpd is only
restarted when something really changed, which is what #12422 intended. A changed PSK still restarts it. PR to follow.

主要语言
Java
星标
3.1k
派生
1.4k
平均合并
10 天 9 小时
30 天内合并 PR
20

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

apache/cloudstack 的其他 Issue

查看 apache/cloudstack 的全部 Issue

相似的 Issue

更多 Java Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。