From 2ee0f4485a7c9d4f250a2d2986cd5b0058ddaba0 Mon Sep 17 00:00:00 2001 From: Mark Gray Date: Mon, 4 Jan 2021 03:45:18 -0500 Subject: [PATCH] ovs-monitor-ipsec: Fix active connection regex. Connections are added to IPsec using a connection name that is determined from the OVS port name and the tunnel type. GRE connections take the form: - Other connections take the form: -in- -out- The regex '|' operator parses strings left to right looking for the first match that it can find. '.*' is also greedy. This causes incorrect interface names to be parsed from active connections as other tunnel types are parsed as type GRE. This gives unexpected "is outdated" warnings and the connection is torn down. For example, 'ovn-424242-in-1' will produce an incorrect interface name of 'ovn-424242-in' instead of 'ovn-424242'. There are a number of ways this could be resolved including a cleverer regular expression, or re.findall(). However, this approach was taken as it simplifies the code easing maintainability. Fixes: 22c5eafb6efa ("ipsec: reintroduce IPsec support for tunneling") Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1908789 Signed-off-by: Mark Gray Acked-by: Eelco Chaudron Acked-by: Flavio Leitner Signed-off-by: Ilya Maximets --- ipsec/ovs-monitor-ipsec.in | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipsec/ovs-monitor-ipsec.in b/ipsec/ovs-monitor-ipsec.in index b72d562c784..f9451e53cd4 100755 --- a/ipsec/ovs-monitor-ipsec.in +++ b/ipsec/ovs-monitor-ipsec.in @@ -625,7 +625,10 @@ conn prevent_unencrypted_vxlan continue conn = m.group(1) - m = re.match(r"(.*)(-in-\d+|-out-\d+|-\d+)", conn) + m = re.match(r"(.*)(-in-\d+|-out-\d+)", conn) + if not m: + # GRE connections have format - + m = re.match(r"(.*)(-\d+)", conn) if not m: continue