Add conntrackd support to HA routers in L3 agent

[Assaf Muller]

Open TCP sessions are discarded during HA router failover. Adding conntrackd support should solve this issue.

Some work has already been done in the following two patches:
https://review.openstack.org/#/c/71586/
https://review.openstack.org/#/c/80332/

[John Schwarz (jschwarz)]

Hi,

Is there any progress with this bug?

John.

[Qin TianHuan (646543317-j-deactivatedaccount)]

Hi yong sheng,

Any progress with this bug? I'll do something on this bug to solve our current problem(which will implement conntracked in L3 HA Router), so if you don't have time on this bug, we can solve it together :)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/184474

[OpenStack Infra (hudson-openstack)]

Change abandoned by QthCN (<email address hidden>) on branch: master
Review: https://review.openstack.org/184474

[Antonio Messina (arcimboldo)]

I'm also interested in this bug, as we are running Neutron L3 agents in HA

[Manjeet Singh Bhatia (manjeet-s-bhatia)]

akamyshnikova I am interested in doing this. sorry it was unassigned i assigned it to me .
can i take that ?

[Ann Taraday (akamyshnikova)]

@Manjeet Singh Bhatia

Sure!

[Hirofumi Ichihara (ichihara-hirofumi)]

@Manjeet Singh Bhatia: I hope this feature is ready in Mitaka. Do you have plan about this?

[Manjeet Singh Bhatia (manjeet-s-bhatia)]

I cherry picked the changes now I am doing additional modifications. also lot of tests are failing in new neutron code base due to this. Ill first fix the tests., then will do operational testing over devstack. once it worked I will push it.

[Hirofumi Ichihara (ichihara-hirofumi)]

@Manjeet Singh Bhatia: Do you still have plan for this bug?

[Ann Taraday (akamyshnikova)]

Any updates?

[Hirofumi Ichihara (ichihara-hirofumi)]

I try it.

[Carl Baldwin (carl-baldwin)]

I'm a bit concerned about the overhead of synchronizing conntrack between routers. In my experience, it is very significant and I actually doubt the benefit somewhat. So, maybe you can help me understand why this is important.

The linux kernel enables the nf_conntrack_tcp_loose sysctl option by default. When this is enabled. Conntrack will pick up existing connections traffic appears coming from the "right" direction, meaning the direction that would be allowed to initiate the session in the first place. In most cases, I imagine that this should be sufficient to maintain continuity for connections.

To me, the description of this bug doesn't adequately justify the developer work and the increase amount of overhead that this feature will add. For example, it doesn't cite any kind of real world experience or testing, it just merely states that connections are discarded and doesn't consider the potential mitigation from the tcp_loose option. I'm very concerned.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]

[Arturo Borrero Gonzalez (arturoborrero)]

This is important for NAT-based connections:
* general SNAT being done by the neutron router on egress
* the floating IP NAT

I don't think TCP connections using NAT in a failover scenario will keep going unless the conntrack info has been synced to the other neutron router.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/917430