From patchwork Mon Sep 5 07:16:45 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arturo Borrero X-Patchwork-Id: 665638 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3sSLd84PJxz9sCg for ; Mon, 5 Sep 2016 17:16:44 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755069AbcIEHQn (ORCPT ); Mon, 5 Sep 2016 03:16:43 -0400 Received: from smtp3.cica.es ([150.214.5.190]:38404 "EHLO smtp.cica.es" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753859AbcIEHQn (ORCPT ); Mon, 5 Sep 2016 03:16:43 -0400 Received: from localhost (unknown [127.0.0.1]) by smtp.cica.es (Postfix) with ESMTP id 093CF51F243 for ; Mon, 5 Sep 2016 07:16:40 +0000 (UTC) X-Virus-Scanned: amavisd-new at cica.es Received: from smtp.cica.es ([127.0.0.1]) by localhost (mail.cica.es [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n_y0D-zC8OTn for ; Mon, 5 Sep 2016 09:16:34 +0200 (CEST) Received: from nfdev2.cica.es (nfdev2.cica.es [IPv6:2a00:9ac0:c1ca:31::221]) (Authenticated sender: servers@cica.es) by smtp.cica.es (Postfix) with ESMTP id B665D51F23B for ; Mon, 5 Sep 2016 09:16:33 +0200 (CEST) Subject: [conntrack-tools PATCH 4/4 v2] doc/manual/conntrack-tools: include some bits about init systems From: Arturo Borrero Gonzalez To: netfilter-devel@vger.kernel.org Date: Mon, 05 Sep 2016 09:16:45 +0200 Message-ID: <147305973403.17904.10544144874704834411.stgit@nfdev2.cica.es> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Update the conntrack-tools manual to include some bits regarding init systems and the integration with systemd. More on this topic here: http://ral-arturo.blogspot.com.es/2016/08/why-conntrackd-in-debian-is-better-with.html Suggested-by: Pablo Neira Ayuso Signed-off-by: Arturo Borrero Gonzalez --- v2: include suggestions reported by Rami Rosen. doc/manual/conntrack-tools.tmpl | 51 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index 87a792e..3e83d78 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -1185,4 +1185,55 @@ not enough space errors: 0 + System integration + + + You may want to integrate conntrackd into your system in order to build + a robust firewall cluster. You should take a look at how the linux + distro of your choose does this, as there are some interesting things + to take into account. + + + + Depending on the architecture of the firewall cluster, you may want to + sync each node after a fallback operation, so the new node + inmediately knows the connection of the other. This is specially + interesting in Active-Active mode. + + + + This can be done using conntrackd -n just after + the new node has joined the conntrackd cluster, for example at boot + time. These operations require the main conntrackd daemon to open the + UNIX socket to receive the order from the + conntrackd -n call. + + + + Care must be taken that no race conditions happens (i.e, the UNIX + socket is actually opened before conntrackd -n is + launched). Otherwise, you may end with a new node (after fallback) + which doesn't know any connection states from the other node. + + + + Since conntrack-tools 1.4.4, the conntrackd + daemon includes integration with libsystemd. If + conntrackd is configured at build time with this support + (using --enable-systemd), then you can + use Systemd on in the + conntrackd.conf main configuration file. + To benefit from this integration, you should use a systemd service file + of Type=notify, which also includes support for + the systemd watchdog. + + + + Using systemd and conntrackd with libsystemd support and a service file + of Type=notify means that conntrackd will notify of its readiness to + systemd, so you can launch conntrackd -n safely, + avoiding such race conditions. + + +