Page MenuHomeVyOS Platform

Support for StartupResync in conntrackd
Open, WishlistPublic

Description

As seen in https://manpages.debian.org/testing/conntrackd/conntrackd.conf.5.en.html (conntrackd version 1:1.4.5-1)

StartupResync <on|off>

Order conntrackd to request a complete conntrack table resync against the other node at startup. A single request will be made.
This is useful to get in sync with another node which has been running while we were down.
Example: StartupResync on
By default, this clause is set off.

(The command-line "-n" does the same if we want to trigger it on some events: https://manpages.debian.org/stretch/conntrackd/conntrackd.8.en.html -- that could be a RFE as well to be put as a command-line)

The use-cases are for rolling upgrade/restarts of firewalls in VRRP configuration:

Worst-Case:
1- You have a long-lived TCP connection going thru the firewall.
2- You restart the VRRP BACKUP appliance, all is well. It goes back online and does not learn all the previous connections.
3- You restart the VRRP MASTER appliance, long-living pre-maintenance TCP connections do break.

Or Best-Case:
1- You have a long-lived TCP connection going thru the firewall.
2- You restart the VRRP MASTER appliance, all is well as the BACKUP has your connection state. It goes back online, becomes BACKUP and does not learn all the previous connections.
3- You restart the VRRP (BACKUP but now) new MASTER appliance, all is well as the BACKUP has your connection state.
4- In any event the VRRP state flips (backup now master, master now backup), long-living TCP connections do break.

Details

Difficulty level
Unknown (require assessment)
Version
1.2.0
Why the issue appeared?
Will be filled on close

Event Timeline

malaiwah triaged this task as Wishlist priority.Feb 12 2019, 6:16 PM
malaiwah created this task.
malaiwah created this object in space S1 VyOS Public.

Found the wishlist priority.

dpkg -l | grep conntrackd

ii conntrackd 1:1.4.2-2+vyos2+current1 amd64 Connection tracking daemon

The version used in VyOS 1.2.0 is unfortunate enough to not have a recent enough version available to support this option.

lsb_release -a

No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 8.11 (jessie)
Release: 8.11
Codename: jessie

hagbard added a subscriber: hagbard.