commit 6fd4720e606ffa91a2db7d0bef1961128014e0ed
author Paul Michali <pc@michali.net> Mon Feb 23 17:07:48 2015 -0500
committer Paul Michali <pc@michali.net> Fri Feb 27 12:05:15 2015 -0500
tree b96c2ac5f5109f2a5d1a02a07d0c78b75aeb8f8c
parent 3ffd5475bfa6c0d68228b9824238be6b096d6e49

VPNaaS Support for StrongSwan driver.

The StrongSwan driver under development for kilo-3 will replace the
default reference OpenSwan driver.

In the interim though, we need to be able to run functional tests
for both drivers. This change is intending to do the additional
steps that are needed to set up for Strongswan, so that when a
functional test has IPSEC_PACKAGE=strongswan, everything will be
correct.

The intent here is to explicitly set the device driver class in
vpn_agent.ini, so that this will work for when OpenSwan is the
default (currently), when no drivers are specified, and will work
for when StrongSwan is made the default in the code.

For Ubuntu, AppArmor is disabled for charon and stroke.

Note: Both OpenSwan and StrongSwan cannot be installed on the
host at the same time.

Change-Id: Ib8467e24633230d6643d812068e4ed6ffb33f104
Partial-Bug: 1424757

lib/neutron

diff --git a/lib/neutron b/lib/neutron
index 8d27feb..2f2c15f 100755
--- a/lib/neutron
+++ b/lib/neutron
@@ -931,7 +931,7 @@
     Q_L3_ROUTER_PER_TENANT=$Q_USE_NAMESPACE
 
     if is_service_enabled q-vpn; then
-        cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini $Q_VPN_CONF_FILE
+        neutron_vpn_configure_agent
     fi
 
     cp $NEUTRON_DIR/etc/l3_agent.ini $Q_L3_CONF_FILE

lib/neutron_plugins/services/vpn

diff --git a/lib/neutron_plugins/services/vpn b/lib/neutron_plugins/services/vpn
index 5912eab..4d6a2bf 100644
--- a/lib/neutron_plugins/services/vpn
+++ b/lib/neutron_plugins/services/vpn
@@ -12,6 +12,13 @@
 
 function neutron_vpn_install_agent_packages {
     install_package $IPSEC_PACKAGE
+    if is_ubuntu && [[ "$IPSEC_PACKAGE" == "strongswan" ]]; then
+        sudo ln -sf /etc/apparmor.d/usr.lib.ipsec.charon /etc/apparmor.d/disable/
+        sudo ln -sf /etc/apparmor.d/usr.lib.ipsec.stroke /etc/apparmor.d/disable/
+        # NOTE: Due to https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1387220
+        # one must use 'sudo start apparmor ACTION=reload' for Ubuntu 14.10
+        restart_service apparmor
+    fi
 }
 
 function neutron_vpn_configure_common {
@@ -19,6 +26,18 @@
     _neutron_deploy_rootwrap_filters $NEUTRON_VPNAAS_DIR
 }
 
+function neutron_vpn_configure_agent {
+    cp $NEUTRON_VPNAAS_DIR/etc/vpn_agent.ini $Q_VPN_CONF_FILE
+    if [[ "$IPSEC_PACKAGE" == "strongswan" ]]; then
+        iniset_multiline $Q_VPN_CONF_FILE vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver
+        if is_fedora; then
+            iniset $Q_VPN_CONF_FILE strongswan default_config_area /usr/share/strongswan/templates/config/strongswan.d
+        fi
+    else
+        iniset_multiline $Q_VPN_CONF_FILE vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.ipsec.OpenSwanDriver
+    fi
+}
+
 function neutron_vpn_stop {
     local ipsec_data_dir=$DATA_DIR/neutron/ipsec
     local pids