Skip to content

Commit 2b4a3c2

Browse files
gsanchiettigsanchietti
committed
feat: add conntrackd config
1 parent 21d4a36 commit 2b4a3c2

File tree

4 files changed

+210
-0
lines changed

4 files changed

+210
-0
lines changed

‎packages/ns-api/files/ns.ha‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,60 @@ import subprocess
1515
import hashlib
1616
import time
1717
from nethsec import firewall
18+
from jinja2 import Template
19+
20+
conntrack_template = """
21+
Sync {
22+
Mode FTFW {
23+
DisableExternalCache Off
24+
CommitTimeout 180
25+
PurgeTimeout 5
26+
}
27+
28+
UDP {
29+
# Dedicated link for connection replication
30+
IPv4_address {{ first_ip }}
31+
IPv4_Destination_Address {{ second_ip }}
32+
Port 3780
33+
Interface {{ ha_interface }}
34+
SndSocketBuffer 1249280
35+
RcvSocketBuffer 1249280
36+
Checksum on
37+
}
38+
}
39+
40+
General {
41+
HashSize 32768
42+
HashLimit 131072
43+
LogFile off
44+
Syslog on
45+
NetlinkOverrunResync 5
46+
NetlinkEventsReliable on
47+
PollSecs 5
48+
EventIterationLimit 200
49+
LockFile /var/lock/conntrack.lock
50+
UNIX {
51+
Path /var/run/conntrackd.ctl
52+
}
53+
NetlinkBufferSize 2097152
54+
NetlinkBufferSizeMaxGrowth 8388608
55+
Filter From Userspace {
56+
Protocol Accept {
57+
TCP
58+
UDP
59+
}
60+
Address Ignore {
61+
IPv4_address 127.0.0.1 # loopback
62+
IPv4_address 10.0.0.1
63+
IPv4_address 10.0.0.2
64+
IPv4_address 10.0.0.3
65+
IPv4_address 192.168.255.2
66+
IPv4_address 192.168.255.52
67+
IPv4_address 192.168.255.250
68+
}
69+
}
70+
}
71+
"""
1872

1973

2074
def setup(role, lan_interface, ha_interface, virtual_ip, ha_main_ipaddress, ha_secondary_ipaddress, pubkey = "", password = ""):
@@ -107,6 +161,12 @@ def setup(role, lan_interface, ha_interface, virtual_ip, ha_main_ipaddress, ha_s
107161
for line in result.stdout.splitlines():
108162
if 'ssh-rsa' in line:
109163
ret['pubkey'] = line
164+
165+
# Setup conntrackd configuration
166+
conntrack_template = Template(conntrack_template)
167+
conntrack_conf = conntrack_template.render(first_ip=ha_main_ipaddress, second_ip=ha_secondary_ipaddress, ha_interface=ha_interface)
168+
with open('/etc/conntrackd/conntrackd.conf', 'w') as file:
169+
file.write(conntrack_conf)
110170
else:
111171
u.set('keepalived', 'ha_receiver', 'track_script')
112172
u.set('keepalived', 'ha_receiver', 'name', 'receiver')
@@ -147,7 +207,16 @@ def setup(role, lan_interface, ha_interface, virtual_ip, ha_main_ipaddress, ha_s
147207
# Change permissions of the rsync directory
148208
os.chmod(rsync_dir, 0o2775)
149209

210+
# Setup conntrackd configuration
211+
conntrack_template = Template(conntrack_template)
212+
conntrack_conf = conntrack_template.render(first_ip=ha_secondary_ipaddress, second_ip=ha_main_ipaddress, ha_interface=ha_interface)
213+
with open('/etc/conntrackd/conntrackd.conf', 'w') as file:
214+
file.write(conntrack_conf)
215+
150216
u.save('keepalived')
217+
# enable and start conntrackd
218+
subprocess.run(['/etc/init.d/conntrackd', 'enable'], capture_output=True)
219+
subprocess.run(['/etc/init.d/conntrackd', 'restart'], capture_output=True)
151220

152221
return ret
153222

‎packages/ns-ha/Makefile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,13 @@ define Package/ns-ha/install
3838
$(INSTALL_DIR) $(1)/usr/sbin
3939
$(INSTALL_DIR) $(1)/etc/hotplug.d/keepalived
4040
$(INSTALL_DIR) $(1)/lib/functions/keepalived
41+
$(INSTALL_DIR) $(1)/usr/libexec
4142
$(INSTALL_BIN) ./files/keepalived-config $(1)/usr/sbin
4243
$(INSTALL_DATA) ./files/600-openvpn $(1)/etc/hotplug.d/keepalived
4344
$(INSTALL_DATA) ./files/900-ns-plug $(1)/etc/hotplug.d/keepalived
45+
$(INSTALL_DATA) ./files/100-conntrackd $(1)/etc/hotplug.d/keepalived
4446
$(INSTALL_DATA) ./files/ns.sh $(1)/lib/functions/keepalived
47+
$(INSTALL_BIN) ./files/conntrackd.sh /usr/libexec/conntrackd.sh
4548
endef
4649

4750
$(eval $(call BuildPackage,ns-ha))

‎packages/ns-ha/files/100-conntrackd‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# shellcheck source=/dev/null
2+
. /lib/functions/keepalived/hotplug.sh
3+
4+
if [ "$ACTION" == "NOTIFY_BACKUP" ]; then
5+
/usr/libexec/conntrackd.sh backup
6+
elif [ "$ACTION" == "NOTIFY_MASTER" ]; then
7+
/usr/libexec/conntrackd.sh primary
8+
elif [ "$ACTION" == "NOTIFY_FAULT" ]; then
9+
/usr/libexec/conntrackd.sh fault
10+
fi
11+
12+
keepalived_hotplug

‎packages/ns-ha/files/conntrackd.sh‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
#!/bin/sh
2+
#
3+
# (C) 2006-2011 by Pablo Neira Ayuso <pablo@netfilter.org>
4+
#
5+
# This program is free software; you can redistribute it and/or modify
6+
# it under the terms of the GNU General Public License as published by
7+
# the Free Software Foundation; either version 2 of the License, or
8+
# (at your option) any later version.
9+
#
10+
# Description:
11+
#
12+
# This is the script for primary-backup setups for keepalived
13+
# (http://www.keepalived.org). You may adapt it to make it work with other
14+
# high-availability managers.
15+
#
16+
# Do not forget to include the required modifications to your keepalived.conf
17+
# file to invoke this script during keepalived's state transitions.
18+
#
19+
# Contributions to improve this script are welcome :).
20+
#
21+
22+
CONNTRACKD_BIN=/usr/sbin/conntrackd
23+
CONNTRACKD_LOCK=/var/lock/conntrack.lock
24+
CONNTRACKD_CONFIG=/etc/conntrackd/conntrackd.conf
25+
26+
case "$1" in
27+
primary)
28+
#
29+
# commit the external cache into the kernel table
30+
#
31+
$CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -c
32+
if [ $? -eq 1 ]
33+
then
34+
logger "ERROR: failed to invoke conntrackd -c"
35+
fi
36+
37+
#
38+
# flush the internal and the external caches
39+
#
40+
$CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -f
41+
if [ $? -eq 1 ]
42+
then
43+
logger "ERROR: failed to invoke conntrackd -f"
44+
fi
45+
46+
#
47+
# resynchronize my internal cache to the kernel table
48+
#
49+
$CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -R
50+
if [ $? -eq 1 ]
51+
then
52+
logger "ERROR: failed to invoke conntrackd -R"
53+
fi
54+
55+
#
56+
# send a bulk update to backups
57+
#
58+
$CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -B
59+
if [ $? -eq 1 ]
60+
then
61+
logger "ERROR: failed to invoke conntrackd -B"
62+
fi
63+
;;
64+
backup)
65+
#
66+
# is conntrackd running? request some statistics to check it
67+
#
68+
$CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -s
69+
if [ $? -eq 1 ]
70+
then
71+
#
72+
# something's wrong, do we have a lock file?
73+
#
74+
if [ -f $CONNTRACKD_LOCK ]
75+
then
76+
logger "WARNING: conntrackd was not cleanly stopped."
77+
logger "If you suspect that it has crashed:"
78+
logger "1) Enable coredumps"
79+
logger "2) Try to reproduce the problem"
80+
logger "3) Post the coredump to netfilter-devel@vger.kernel.org"
81+
rm -f $CONNTRACKD_LOCK
82+
fi
83+
$CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -d
84+
if [ $? -eq 1 ]
85+
then
86+
logger "ERROR: cannot launch conntrackd"
87+
exit 1
88+
fi
89+
fi
90+
#
91+
# shorten kernel conntrack timers to remove the zombie entries.
92+
#
93+
$CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -t
94+
if [ $? -eq 1 ]
95+
then
96+
logger "ERROR: failed to invoke conntrackd -t"
97+
fi
98+
99+
#
100+
# request resynchronization with master firewall replica (if any)
101+
# Note: this does nothing in the alarm approach.
102+
#
103+
$CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -n
104+
if [ $? -eq 1 ]
105+
then
106+
logger "ERROR: failed to invoke conntrackd -n"
107+
fi
108+
;;
109+
fault)
110+
#
111+
# shorten kernel conntrack timers to remove the zombie entries.
112+
#
113+
$CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -t
114+
if [ $? -eq 1 ]
115+
then
116+
logger "ERROR: failed to invoke conntrackd -t"
117+
fi
118+
;;
119+
*)
120+
logger "ERROR: unknown state transition"
121+
echo "Usage: primary-backup.sh {primary|backup|fault}"
122+
exit 1
123+
;;
124+
esac
125+
126+
exit 0

0 commit comments

Comments
 (0)