OpenStack-Neutron-VPNaaS-代码

def create_ipsec_site_connection(self, context, ipsec_site_connection):
    ipsec_site_connection = super(
        VPNDriverPlugin, self).create_ipsec_site_connection(
            context, ipsec_site_connection)# 1.创建数据库记录
    driver = self._get_driver_for_ipsec_site_connection(
        context, ipsec_site_connection) # 2.获取driver，在配置文件配置的，这里是ipsec
    driver.create_ipsec_site_connection(context, ipsec_site_connection) #3.调用vpn_service类中的方法开始底层的操作
    return ipsec_site_connection

def create_ipsec_site_connection(self, context, ipsec_site_connection):
    vpnservice = self.service_plugin._get_vpnservice(
        context, ipsec_site_connection[‘vpnservice_id‘])
    self.agent_rpc.vpnservice_updated(context, vpnservice[‘router_id‘])

def sync(self, context, routers):
    vpnservices = self.agent_rpc.get_vpn_services_on_host(
        context, self.host)#获取数据库中有关vpn的记录列表
    router_ids = [vpnservice[‘router_id‘] for vpnservice in vpnservices]
    # Ensure the ipsec process is enabled
    for vpnservice in vpnservices:
        process = self.ensure_process(vpnservice[‘router_id‘],
                                      vpnservice=vpnservice) #创建openswan进程，初始化文件和目录，数据库字段过滤等等
        self._update_nat(vpnservice, self.agent.add_nat_rule) #在路由空间中创建nat规则
        process.update() #启动openswan进程

    # Delete any IPSec processes that are
    # associated with routers, but are not running the VPN service.
    for router in routers:
        #We are using router id as process_id
        process_id = router[‘id‘]
        if process_id not in router_ids:
            process = self.ensure_process(process_id)
            self.destroy_router(process_id)

    # Delete any IPSec processes running
    # VPN that do not have an associated router.
    process_ids = [process_id
                   for process_id in self.processes
                   if process_id not in router_ids]
    for process_id in process_ids:
        self.destroy_router(process_id)
    self.report_status(context)

def update(self):
    """Update Status based on vpnservice configuration."""
    if self.vpnservice and not self.vpnservice[‘admin_state_up‘]:
        self.disable()
    else:
        self.enable()

    if plugin_utils.in_pending_status(self.vpnservice[‘status‘]):
        self.updated_pending_status = True

    self.vpnservice[‘status‘] = self.status
    for ipsec_site_conn in self.vpnservice[‘ipsec_site_connections‘]:
        if plugin_utils.in_pending_status(ipsec_site_conn[‘status‘]):
            conn_id = ipsec_site_conn[‘id‘]
            conn_status = self.connection_status.get(conn_id)
            if not conn_status:
                continue
            conn_status[‘updated_pending_status‘] = True
            ipsec_site_conn[‘status‘] = conn_status[‘status‘]

def start(self):
    """Start the process.

    Note: if there is not namespace yet,
    just do nothing, and wait next event.
    """
    if not self.namespace:
        return
    virtual_private = self._virtual_privates()
    self.clear_pid() #这里需要清空对应目录中的pid文件，不然会报错

    #start pluto IKE keying daemon
　　#启动IKE守护进程
    self._execute([self.binary,
                   ‘pluto‘,
                   ‘--ctlbase‘, self.pid_path,
                   ‘--ipsecdir‘, self.ipsecd_dir,
                   #‘--use-netkey‘,
                   ‘--uniqueids‘,
                   ‘--nat_traversal‘,
                   ‘--secretsfile‘, self.secrets_file,
                   ‘--virtual_private‘, virtual_private
                   ])
    #add connections
    for ipsec_site_conn in self.vpnservice[‘ipsec_site_connections‘]:
        nexthop = self._get_nexthop(ipsec_site_conn[‘peer_address‘])
        self._execute([self.binary,
                       ‘addconn‘,
                       ‘--ctlbase‘, ‘%s.ctl‘ % self.pid_path,
                      # ‘--defaultroutenexthop‘, nexthop,
                       ‘--config‘, self.config_file,
                       ipsec_site_conn[‘id‘]
                       ])
    #TODO(nati) fix this when openswan is fixed
    #Due to openswan bug, this command always exit with 3
    #start whack ipsec keying daemon
    self._execute([self.binary,
                   ‘whack‘,
                   ‘--ctlbase‘, self.pid_path,
                   ‘--listen‘,
                   ], check_exit_code=False)

    for ipsec_site_conn in self.vpnservice[‘ipsec_site_connections‘]:
        if not ipsec_site_conn[‘initiator‘] == ‘start‘:
            continue

        #initiate ipsec connection
        self._execute([self.binary,
                       ‘whack‘,
                       ‘--ctlbase‘, self.pid_path,
                       ‘--name‘, ipsec_site_conn[‘id‘],
                       ‘--asynchronous‘,
                       ‘--initiate‘
                       ])