Routed VR: accept VRRP and conntrackd sync on redundant routers - #14446

Description

This PR fixes redundant VRs of ROUTED isolated networks and VPCs coming up as PRIMARY on both routers.

In ROUTED mode the VR flushes iptables and builds nftables tables (ip4_firewall for isolated networks, ip4_acl for VPCs) whose INPUT chain has a drop policy. The INPUT whitelist built by fw_router_routing and fw_vpcrouter_routing lacks VRRP (224.0.0.18) and conntrackd (225.0.0.50) multicast, which fw_router / fw_vpcrouter accept for non-routed networks. Both routers drop each other's VRRP advertisements and both become PRIMARY.

This adds iifname <guest dev> ip daddr 224.0.0.18 counter accept and iifname <guest dev> ip daddr 225.0.0.50 counter accept to the INPUT whitelist of both functions, plus unit tests. The rules match the destination address rather than the protocol because keepalived uses AH authentication, so the advertisements are IP protocol 51, not 112.

Redundant ROUTED offerings can be created on 4.20 (the RedundantRouter capability on the Gateway service was added for ROUTED in #9470), so this targets 4.20 as a bug fix, following CONTRIBUTING.md. If you would rather take it as part of #11565 on main, I can retarget the PR; the commit cherry-picks cleanly onto main and the new tests pass there.

Fixes: #14445

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• build/CI
• test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

How Has This Been Tested?

Unit tests: the two new tests in TestCsAddress.TestCsIPRouted pass. pycodestyle (--max-line-length=179) and pylint report nothing new for the changed files; the two TestCsRoute failures in a container are pre-existing (they need a real default route).

Test environment: management server 4.20.3.1, KVM on CentOS 8, systemvm template 4.20.2. The change was applied to /usr/share/cloudstack-common/vms/cloud-scripts.tgz on the host, which the agent copies into the VR at boot (the new md5 showed up as the routers' scripts version).

• Isolated network, ROUTED Static, redundant offering (created via API, RedundantRouter capability on the Gateway service): before the change both VRs were PRIMARY; after, PRIMARY/BACKUP, and the INPUT counters of the new rules show VRRP and conntrackd traffic being accepted. Forced stop of the primary: about 3 s of ping loss, and the stopped VR rejoins as BACKUP when started again (nopreempt).
• Isolated network, ROUTED Dynamic, with an FRR peer: PRIMARY/BACKUP. The backup's BGP session stays Active (its public interface is down), and after a failover the new primary establishes the session.
• VPC, ROUTED Dynamic, redundant VPC offering: PRIMARY/BACKUP, about 6 s of ping loss on failover.

How did you try to break this feature and the system with this change?

• Only fw_router_routing and fw_vpcrouter_routing change, and both return early unless the network is ROUTED, so non-routed VRs are not affected.
• The new rules accept only the two link-local multicast groups on the guest interface, the same addresses the iptables path already accepts.
• On non-redundant routed networks the rules never match anything.

Not addressed here, but possibly useful for #11565: during a BGP failover the peer may refuse the new primary with a Connection Collision until the stale session from the old primary is torn down. With default timers this caused about 20 s without the route in our test, and with keepalive 3 s / hold 9 s on the peer the total failover was about 5 s.

🤖 Generated with Claude Code