Page MenuHomeVyOS Platform

Add support for StartupResync in conntrack-sync
Closed, ResolvedPublic

Description

As seen in https://manpages.debian.org/testing/conntrackd/conntrackd.conf.5.en.html (conntrackd version 1:1.4.5-1)

StartupResync <on|off>

Order conntrackd to request a complete conntrack table resync against the other node at startup. A single request will be made.
This is useful to get in sync with another node which has been running while we were down.
Example: StartupResync on
By default, this clause is set off.

(The command-line "-n" does the same if we want to trigger it on some events: https://manpages.debian.org/stretch/conntrackd/conntrackd.8.en.html -- that could be a RFE as well to be put as a command-line)

The use-cases are for rolling upgrade/restarts of firewalls in VRRP configuration:

Worst-Case:
1- You have a long-lived TCP connection going thru the firewall.
2- You restart the VRRP BACKUP appliance, all is well. It goes back online and does not learn all the previous connections.
3- You restart the VRRP MASTER appliance, long-living pre-maintenance TCP connections do break.

Or Best-Case:
1- You have a long-lived TCP connection going thru the firewall.
2- You restart the VRRP MASTER appliance, all is well as the BACKUP has your connection state. It goes back online, becomes BACKUP and does not learn all the previous connections.
3- You restart the VRRP (BACKUP but now) new MASTER appliance, all is well as the BACKUP has your connection state.
4- In any event the VRRP state flips (backup now master, master now backup), long-living TCP connections do break.

Details

Difficulty level
Unknown (require assessment)
Version
1.2.0
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Improvement (missing useful functionality)

Event Timeline

malaiwah triaged this task as Wishlist priority.
malaiwah created this object in space S1 VyOS Public.

Found the wishlist priority.

dpkg -l | grep conntrackd

ii conntrackd 1:1.4.2-2+vyos2+current1 amd64 Connection tracking daemon

The version used in VyOS 1.2.0 is unfortunate enough to not have a recent enough version available to support this option.

lsb_release -a

No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 8.11 (jessie)
Release: 8.11
Codename: jessie

hagbard subscribed.
dmbaturin set Is it a breaking change? to Unspecified (possibly destroys the router).
dmbaturin added a project: VyOS 1.4 Sagitta.
natali-rs1985 set Issue type to Unspecified (please specify).
natali-rs1985 changed Issue type from Unspecified (please specify) to Feature (new functionality).Mar 13 2024, 1:08 PM
natali-rs1985 changed the task status from Open to In progress.Apr 5 2024, 10:47 AM
dmbaturin renamed this task from Support for StartupResync in conntrackd to Add support for StartupResync in conntrack-sync.May 10 2024, 7:42 PM
dmbaturin removed a project: VyOS 1.5 Circinus.
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.May 11 2024, 5:56 PM
dmbaturin changed Issue type from Feature (new functionality) to Improvement (missing useful functionality).