From 4d11715bd936d5d111bb3cd6e289ef2b3c3c218a Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Tue, 11 May 2021 19:15:51 +0200 Subject: conntrack: T3535: migrate codebase from vyatta-conntrack-sync --- .../service_conntrack-sync.xml.in | 168 +++++++++++++++++++++ 1 file changed, 168 insertions(+) create mode 100644 interface-definitions/service_conntrack-sync.xml.in (limited to 'interface-definitions') diff --git a/interface-definitions/service_conntrack-sync.xml.in b/interface-definitions/service_conntrack-sync.xml.in new file mode 100644 index 000000000..45d211479 --- /dev/null +++ b/interface-definitions/service_conntrack-sync.xml.in @@ -0,0 +1,168 @@ + + + + + + + Connection tracking synchronization + 995 + + + + + Protocols for which local conntrack entries will be synced + + tcp udp icmp sctp + + + tcp + Sync Transmission Control Protocol conntrack entries + + + udp + Sync User Datagram Protocol conntrack entries + + + icmp + Sync Internet Control Message Protocol conntrack entries + + + sctp + Sync Stream Control Transmission Protocol conntrack entries + + + ^(tcp|udp|icmp|sctp)$ + + Allowed protocols: tcp udp icmp or sctp + + + + + + Directly injects the flow-states into the in-kernel Connection Tracking System of the backup firewall. + + + + + + Queue size for local conntrack events + + u32 + Queue size in MB + + + 8 + + + + Protocol for which expect entries need to be synchronized + + all ftp sip h323 nfs sqlnet + + + ^(all|ftp|sip|h323|nfs|sqlnet)$ + + Invalid protocol + + + + + + Failover mechanism to use for conntrack-sync + + + + + Cluster as failover-mechanism to use for conntrack-sync + + + + + Cluster group [DEPRECATED] + + + + + + + VRRP as failover-mechanism to use for conntrack-sync + + + + + VRRP sync group [REQUIRED] + + high-availability vrrp sync-group + + + + + + + + + + IP addresses for which local conntrack entries will not be synced + + ipv4 + IPv4 address to ignore + + + ipv4net + IPv4 prefix to ignore + + + ipv6 + IPv6 address to ignore + + + ipv6net + IPv6 prefix to ignore + + + + + + + + + + + Interface to use for syncing conntrack entries + + + + + + + + IP address of the peer to send the UDP conntrack info too. This disable multicast. + + + + + #include + + + Multicast group to use for syncing conntrack entries + + + + + 225.0.0.50 + + + + Queue size for syncing conntrack entries + + u32 + Queue size in MB + + + 1 + + + + + + -- cgit v1.2.3 From cd59f198366ce58a01887e4f900a746d5b10b161 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 14 May 2021 21:26:01 +0200 Subject: conntrack: T3535: remove cluster CLI nodes --- interface-definitions/service_conntrack-sync.xml.in | 12 ------------ src/migration-scripts/conntrack-sync/1-to-2 | 5 +++++ 2 files changed, 5 insertions(+), 12 deletions(-) (limited to 'interface-definitions') diff --git a/interface-definitions/service_conntrack-sync.xml.in b/interface-definitions/service_conntrack-sync.xml.in index 45d211479..2953ae390 100644 --- a/interface-definitions/service_conntrack-sync.xml.in +++ b/interface-definitions/service_conntrack-sync.xml.in @@ -71,18 +71,6 @@ Failover mechanism to use for conntrack-sync - - - Cluster as failover-mechanism to use for conntrack-sync - - - - - Cluster group [DEPRECATED] - - - - VRRP as failover-mechanism to use for conntrack-sync diff --git a/src/migration-scripts/conntrack-sync/1-to-2 b/src/migration-scripts/conntrack-sync/1-to-2 index 3a76fc0e0..ebbd8c35a 100755 --- a/src/migration-scripts/conntrack-sync/1-to-2 +++ b/src/migration-scripts/conntrack-sync/1-to-2 @@ -53,6 +53,11 @@ else: for address in tmp: config.set(base + ['ignore-address'], value=address, replace=False) + # we no longer support cluster mode + base_cluster = base + ['failover-mechanism', 'cluster'] + if config.exists(base_cluster): + config.delete(base_cluster) + try: with open(file_name, 'w') as f: f.write(config.to_string()) -- cgit v1.2.3 From 3fc9b2fb79fd3e27a5034804e5243fe2e4ec40c3 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 14 May 2021 21:26:25 +0200 Subject: conntrack: T3535: check for VRRP group definition --- interface-definitions/service_conntrack-sync.xml.in | 2 +- src/conf_mode/conntrack_sync.py | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) (limited to 'interface-definitions') diff --git a/interface-definitions/service_conntrack-sync.xml.in b/interface-definitions/service_conntrack-sync.xml.in index 2953ae390..088cd78f6 100644 --- a/interface-definitions/service_conntrack-sync.xml.in +++ b/interface-definitions/service_conntrack-sync.xml.in @@ -78,7 +78,7 @@ - VRRP sync group [REQUIRED] + VRRP sync group high-availability vrrp sync-group diff --git a/src/conf_mode/conntrack_sync.py b/src/conf_mode/conntrack_sync.py index c1c90d1fc..e0a414745 100755 --- a/src/conf_mode/conntrack_sync.py +++ b/src/conf_mode/conntrack_sync.py @@ -21,6 +21,7 @@ from vyos.config import Config from vyos.configdict import dict_merge from vyos.configverify import verify_interface_exists from vyos.util import call +from vyos.util import dict_search from vyos.util import read_file from vyos.template import render from vyos.template import get_ipv4 @@ -51,6 +52,9 @@ def get_config(config=None): conntrack['hash_size'] = read_file('/sys/module/nf_conntrack/parameters/hashsize') conntrack['table_size'] = read_file('/proc/sys/net/netfilter/nf_conntrack_max') + conntrack['vrrp'] = conf.get_config_dict(['high-availability', 'vrrp', 'sync-group'], + get_first_key=True) + return conntrack def verify(conntrack): @@ -75,6 +79,12 @@ def verify(conntrack): if not is_addr_assigned(address): raise ConfigError(f'Specified listen-address {address} not assigned to any interface!') + vrrp_group = dict_search('failover_mechanism.vrrp.sync_group', conntrack) + if vrrp_group == None: + raise ConfigError(f'No VRRP sync-group defined!') + if vrrp_group not in conntrack['vrrp']: + raise ConfigError(f'VRRP sync-group {vrrp_group} not configured!') + return None def generate(conntrack): -- cgit v1.2.3