[pve-devel] [PATCH qemu-server v5 08/11] migrate: flush old VM conntrack entries after successful migration

[Christoph Heiss]

After a successful live-migration, the old VM-specific conntrack entries
are not needed anymore on the source node and can thus be flushed.

Tested-by: Stefan Hanreich <s.hanreich at proxmox.com>
Signed-off-by: Christoph Heiss <c.heiss at proxmox.com>
---
Changes v1 -> v2:
  * no changes

Changes v2 -> v3:
  * formatted using perltidy
  * adjusted info message by adding `[on source] node` at end for
    better context

Changes v3 -> v4:
  * no changes

Changes v4 -> v5:
  * no changes

 src/PVE/QemuMigrate.pm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/PVE/QemuMigrate.pm b/src/PVE/QemuMigrate.pm
index e4fbcbbe..e18cc2aa 100644
--- a/src/PVE/QemuMigrate.pm
+++ b/src/PVE/QemuMigrate.pm
@@ -11,6 +11,7 @@ use Time::HiRes qw( usleep );
 use PVE::AccessControl;
 use PVE::Cluster;
 use PVE::Format qw(render_bytes);
+use PVE::Firewall::Helpers;
 use PVE::GuestHelpers qw(safe_boolean_ne safe_string_ne);
 use PVE::INotify;
 use PVE::JSONSchema;
@@ -1761,6 +1762,10 @@ sub phase3_cleanup {
             if (my $err = $@) {
                 $self->log('warn', "failed to stop dbus-vmstate on $targetnode: $err\n");
             }
+
+            # also flush now-old local conntrack entries for the migrated VM
+            $self->log('info', 'flushing conntrack state for guest on source node');
+            PVE::Firewall::Helpers::flush_fw_ct_entries_by_mark($vmid);
         }
     }
 
-- 
2.49.0