[pve-devel] [PATCH qemu-server v2] copy conntrack information on migration

[Mira Limbeck]

Requires the pve-conntrack-tool. On migration the conntrack information
from the source node is dumped and sent to the target node where it is
then inserted.
This helps with open connections during migration when the firewall is active.

A new 'migrate-conntracks' option is added to the migrate_vm API call.

Signed-off-by: Mira Limbeck <m.limbeck at proxmox.com>
---
v2:
 - added the migrate-conntracks option so that it only copies conntrack
   information when requested

 PVE/API2/Qemu.pm   | 5 +++++
 PVE/QemuMigrate.pm | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 3571f5e..8c4336b 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -3556,6 +3556,11 @@ __PACKAGE__->register_method({
 		minimum => '0',
 		default => 'migrate limit from datacenter or storage config',
 	    },
+	    'migrate-conntracks' => {
+		description => "Migrate connection tracking info.",
+		type => 'boolean',
+		optional => 1,
+	    }
 	},
     },
     returns => {
diff --git a/PVE/QemuMigrate.pm b/PVE/QemuMigrate.pm
index 5c019fc..2ccef2a 100644
--- a/PVE/QemuMigrate.pm
+++ b/PVE/QemuMigrate.pm
@@ -1087,6 +1087,11 @@ sub phase2 {
 	    die "unable to parse migration status '$stat->{status}' - aborting\n";
 	}
     }
+
+    if ($self->{opts}->{'migrate-conntracks'}) {
+	$self->log('info', 'copy conntrack information');
+	PVE::Tools::run_command([['/usr/bin/pve-conntrack-tool', 'dump'], [@{$self->{rem_ssh}}, '/usr/bin/pve-conntrack-tool', 'insert']]);
+    }
 }
 
 sub phase2_cleanup {
-- 
2.20.1