starlingx/config
Code Issues Proposed changes

Decrease ipsec-config stop time

Browse Source 
It is found that ipsec-config SM service takes about 57s to stop during
controller swact. This is caused by the blocking command
"swanctl --terminate" in ipsec-config's ocf script. This change added
"--force" option to the command so it will terminate IKE_SA without
waiting. The stop time is reduced to about 12s with this change.

Test Plan:
PASS: On a DX system, swact active controller, multiple times, verify
      the swact is successful, system is stable after swact, IPsec is
      properly configured and SAs are established as expected.
PASS: Multiple iterations of controlled and uncontrolled swact on HW
      labs, verify there are no issues arise.

Story: 2010940
Task: 51242

Change-Id: I68474c6373ccf1941d05943c9b3906b436e1f788
Signed-off-by: Andy Ning <andy.ning@windriver.com>
This commit is contained in:
Andy Ning 2024-10-31 15:36:38 -04:00
parent 8940adf4a8
commit d662842c86
1 changed files with 1 additions and 1 deletions

2
sysinv/ipsec-auth/files/ipsec-config

@ -147,7 +147,7 @@ update_ipsec_config() {
return ${OCF_ERR_CONFIGURED}
fi
/usr/sbin/swanctl --terminate --ike system-nodes
/usr/sbin/swanctl --terminate --ike system-nodes --force
if [ $? -ne 0 ] ; then
ocf_log warn "Failed to terminate existing IPsec connections"