Page MenuHomeVyOS Platform

Support for StartupResync in conntrackd
Open, WishlistPublic

Description

As seen in https://manpages.debian.org/testing/conntrackd/conntrackd.conf.5.en.html (conntrackd version 1:1.4.5-1)

StartupResync <on|off>

Order conntrackd to request a complete conntrack table resync against the other node at startup. A single request will be made.
This is useful to get in sync with another node which has been running while we were down.
Example: StartupResync on
By default, this clause is set off.

(The command-line "-n" does the same if we want to trigger it on some events: https://manpages.debian.org/stretch/conntrackd/conntrackd.8.en.html -- that could be a RFE as well to be put as a command-line)

The use-cases are for rolling upgrade/restarts of firewalls in VRRP configuration:

Worst-Case:
1- You have a long-lived TCP connection going thru the firewall.
2- You restart the VRRP BACKUP appliance, all is well. It goes back online and does not learn all the previous connections.
3- You restart the VRRP MASTER appliance, long-living pre-maintenance TCP connections do break.

Or Best-Case:
1- You have a long-lived TCP connection going thru the firewall.
2- You restart the VRRP MASTER appliance, all is well as the BACKUP has your connection state. It goes back online, becomes BACKUP and does not learn all the previous connections.
3- You restart the VRRP (BACKUP but now) new MASTER appliance, all is well as the BACKUP has your connection state.
4- In any event the VRRP state flips (backup now master, master now backup), long-living TCP connections do break.

Details

Difficulty level
Unknown (require assessment)
Version
1.2.0
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)

Event Timeline

malaiwah triaged this task as Wishlist priority.Feb 12 2019, 6:16 PM
malaiwah created this task.
malaiwah created this object in space S1 VyOS Public.

Found the wishlist priority.

dpkg -l | grep conntrackd

ii conntrackd 1:1.4.2-2+vyos2+current1 amd64 Connection tracking daemon

The version used in VyOS 1.2.0 is unfortunate enough to not have a recent enough version available to support this option.

lsb_release -a

No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 8.11 (jessie)
Release: 8.11
Codename: jessie

hagbard added a subscriber: hagbard.
dmbaturin set Is it a breaking change? to Unspecified (possibly destroys the router).
dmbaturin added a project: VyOS 1.4 Sagitta.