hulucc opened a new pull request, #14446: URL: https://github.com/apache/cloudstack/pull/14446
### Description This PR fixes redundant VRs of ROUTED isolated networks and VPCs coming up as PRIMARY on both routers. In ROUTED mode the VR flushes iptables and builds nftables tables (`ip4_firewall` for isolated networks, `ip4_acl` for VPCs) whose INPUT chain has a drop policy. The INPUT whitelist built by `fw_router_routing` and `fw_vpcrouter_routing` lacks VRRP (224.0.0.18) and conntrackd (225.0.0.50) multicast, which `fw_router` / `fw_vpcrouter` accept for non-routed networks. Both routers drop each other's VRRP advertisements and both become PRIMARY. This adds `iifname <guest dev> ip daddr 224.0.0.18 counter accept` and `iifname <guest dev> ip daddr 225.0.0.50 counter accept` to the INPUT whitelist of both functions, plus unit tests. The rules match the destination address rather than the protocol because keepalived uses AH authentication, so the advertisements are IP protocol 51, not 112. Redundant ROUTED offerings can be created on 4.20 (the RedundantRouter capability on the Gateway service was added for ROUTED in #9470), so this targets 4.20 as a bug fix, following CONTRIBUTING.md. If you would rather take it as part of #11565 on main, I can retarget the PR; the commit cherry-picks cleanly onto main and the new tests pass there. Fixes: #14445 ### Types of changes - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] New feature (non-breaking change which adds functionality) - [x] Bug fix (non-breaking change which fixes an issue) - [ ] Enhancement (improves an existing feature and functionality) - [ ] Cleanup (Code refactoring and cleanup, that may add test cases) - [ ] build/CI - [ ] test (unit or integration test code) ### Feature/Enhancement Scale or Bug Severity #### Feature/Enhancement Scale - [ ] Major - [ ] Minor #### Bug Severity - [ ] BLOCKER - [ ] Critical - [x] Major - [ ] Minor - [ ] Trivial ### Screenshots (if appropriate): ### How Has This Been Tested? Unit tests: the two new tests in `TestCsAddress.TestCsIPRouted` pass. pycodestyle (`--max-line-length=179`) and pylint report nothing new for the changed files; the two `TestCsRoute` failures in a container are pre-existing (they need a real default route). Test environment: management server 4.20.3.1, KVM on CentOS 8, systemvm template 4.20.2. The change was applied to `/usr/share/cloudstack-common/vms/cloud-scripts.tgz` on the host, which the agent copies into the VR at boot (the new md5 showed up as the routers' scripts version). - Isolated network, ROUTED Static, redundant offering (created via API, `RedundantRouter` capability on the Gateway service): before the change both VRs were PRIMARY; after, PRIMARY/BACKUP, and the INPUT counters of the new rules show VRRP and conntrackd traffic being accepted. Forced stop of the primary: about 3 s of ping loss, and the stopped VR rejoins as BACKUP when started again (nopreempt). - Isolated network, ROUTED Dynamic, with an FRR peer: PRIMARY/BACKUP. The backup's BGP session stays Active (its public interface is down), and after a failover the new primary establishes the session. - VPC, ROUTED Dynamic, redundant VPC offering: PRIMARY/BACKUP, about 6 s of ping loss on failover. #### How did you try to break this feature and the system with this change? - Only `fw_router_routing` and `fw_vpcrouter_routing` change, and both return early unless the network is ROUTED, so non-routed VRs are not affected. - The new rules accept only the two link-local multicast groups on the guest interface, the same addresses the iptables path already accepts. - On non-redundant routed networks the rules never match anything. Not addressed here, but possibly useful for #11565: during a BGP failover the peer may refuse the new primary with a Connection Collision until the stale session from the old primary is torn down. With default timers this caused about 20 s without the route in our test, and with keepalive 3 s / hold 9 s on the peer the total failover was about 5 s. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
