[WIP] [FEAT-18702] LMCT - Supporting Zone Based Conntrack Migration by abhishekgangwar-ntnx · Pull Request #17 · nutanix/conntrack-migrator

abhishekgangwar-ntnx · 2026-05-15T10:29:24Z

Command-Line Interface Updates

Automatically detects if the daemon is in legacy "IP-based" mode or the new "port + CT-zone" mode based on argument counts.
Ensures backward compatibility so that existing callers using the old format continue to function without changes.

Zone-Based Filtering & Entry Capture

Implements a new SAVE path that identifies conntrack entries by CT zone rather than VM IP.
Adapts entry validation to the active mode: legacy mode rejects entries with zones, while the new zone mode requires them for accurate matching.
Captures reply-side attributes (L3_SRC_V4_REPL, L3_DST_V4_REPL, etc.) to ensure NAT’d entries are preserved when migration happens.

Zone Remapping on Load

Rewrites incoming entry zones from old values to new values during the LOAD process using a provided mapping list (port_uuid, old_ct_zone, new_ct_zone).

Manual Testing

Testing results are documented here: https://docs.google.com/document/d/1kIUDR6MHAgBASPSjUHSeqdXUdwdMtRGr5qjdOXR1LK8/edit?tab=t.0

Note

Currently test files are not updated so the tests present in testfiles will fail for the time being.

mansish404

Review is mainly around code structuring, naming conventions, and coding style for now. Please address the necessary comments first.

Once the cleanup is done, I’ll review the deeper functionality and workflows.

One suggestion while making changes of this scale — try to keep variables and functions as close to the feature implementation as possible. Using generic terms like strides/offsets is fine where it makes sense, but avoid over-engineering the abstractions.

The code should be easy for someone new to understand and immediately identify what functionality is being implemented. Right now, because of the naming conventions and abstractions used, it’s difficult to map the code back to the actual feature being introduced.

Ideally, a developer should not need to refer to the design doc just to understand what functionality this patch is implementing.

…for zone

…g properly , the second tuple's proto was not set: corrected it

… mode

…d load mode

- dmain: goto-cleanup; on error, call dbus_server_request_quit before pthread_join so the dbus thread doesn't block forever in g_main_loop_run. - dbus_server: add dbus_server_request_quit, plus loop/should_quit/ loop_mu on dbus_targs so the quit signal is race-free against a thread still on its way to g_main_loop_new. - apply_zone_rewrite: use g_hash_table_lookup_extended so an old_zone -> 0 remap isn't silently dropped. - conntrack_events_callback: nfct_destroy(ct) on all early returns (validate_ct_entry fail, zone-mismatch) via a single label. - append_ct_to_batch: return int; on nfct_nlmsg_build failure the caller drops the entry and skips mnl_nlmsg_batch_next so the partial slot is overwritten instead of sent to the kernel.

Adds ensure_cli_arg_is_int_at_least() in common.{h,c} — strtol-based, errx's on empty/non-numeric/negative input and int overflow, base locked to 10. Routes all 10 atoi() sites in main.c through it with per-arg minimums as named constants (MIN_ACCEPTABLE_VALUE_FOR_{MODE, NUM_ENTRIES, NUM_IPS}). dmain now also runs check_mode() after parsing so out-of-set modes can't reach the post-fork grandchild.

The save_targets->ports_to_migrate hashtable (port_uuid -> CT zone) was built and freed but never read; every consumer of save_targets reads only ->kind, ->ips_to_migrate and ->zones_to_migrate. Removes the field and all the plumbing that fed it

Promote struct save_targets, struct ct_delete_args, and struct delete_ct_dump_cb_args from documented tagged unions to real anonymous unions over the active SAVE sub-mode. Anonymous inner structs preserve flat field access at call sites (e.g. cb_args->ips_migrated, targets->zones_to_migrate), while the two mode arms now share storage and are mutually exclusive at the type level.

dmain() so it stops re-walking argv after the double fork (the old "parent's stack is gone after fork" comment was wrong; fork copies the entire AS). detect_*_input_kind now publishes its already-parsed N via an out-param so check_args adds zero extra parses on argv[3].

based clear rpc invocation.

GDBus callbacks, post-fork dmain, libc-facing check_args) and at the helpers that take caller-supplied pointers or counts (hashtable builders, save_targets/load_targets allocators, conntrack_entry builders).

…locator independent of argv layout (mirroring the SAVE side). Optimize duplicate old_zone check via g_hash_table_lookup_extended() Tighten n_entries guard to <= 0 Replace magic +1/+2 offsets with named variables

…d helpers from start_in_save_mode, making it clean and readable plus ensuring that the events-create error path now correctly wakes and joins the delete thread rather than leaving it orphaned on clear_called_cond. Additionally, it replaces the hand-rolled UUID validator with uuid_parse() from libuuid and updates the Makefile and README to include the necessary -luuid flag and libuuid-devel build dependencies.

…d from future risks

… listen_for_conntrack_events (since the zone path never touches them). the LOAD-mode (old_zone -> new_zone) remap build is done while check_zone_load_args. This allows it to happen just once during pre-fork CLI validation

…attributes do not corrupt the migrator and changed data_template_new to create data template as per the requirement (if ip mode then 21 attr otherwise 25)

… it might lead to inconsistency and wrong result, because there is no separation of zones in our setup thus they are not even required.

…e save and load mode enums separate to keep the readability for parameters in several methods

abhishekgangwar-ntnx requested a review from mansish404 May 15, 2026 10:29

abhishekgangwar-ntnx changed the title ~~[WIP] LMCT - Supporting Zone Based Conntrack Migration~~ [WIP] [FEAT-18702] LMCT - Supporting Zone Based Conntrack Migration May 18, 2026

mansish404 requested changes May 22, 2026

View reviewed changes

abhishekgangwar-ntnx added 24 commits May 26, 2026 14:16

added parsing for zone based command

3279651

now zone based filtering is supported along with nat'd entry support …

3af74d8

…for zone

corrected bug: in zone_load mode the pair of tuples was not generatin…

76dcf3e

…g properly , the second tuple's proto was not set: corrected it

added zone mapping to replace old zone to new zone in zone based load…

f814144

… mode

added zone mapping to replace the old zone with new zone in zone base…

893fee0

…d load mode

cleaner start_in_save_mode method, used if else and shift retun at end

fe07c0d

corrected the port_uuid arg support

cfc13c0

added delete conntrack entries for case of zone based save mode

03c4b4c

corrected spacing in common.h

3f9d5cf

supporting clear on port-zone invocation

45260f1

changed the on_clear payload name to resemble both ips and zone

7dc80ca

based clear rpc invocation.

Adds defensive checks at every external boundary (thread entrypoints,

92cbf8e

GDBus callbacks, post-fork dmain, libc-facing check_args) and at the helpers that take caller-supplied pointers or counts (hashtable builders, save_targets/load_targets allocators, conntrack_entry builders).

added const to the parameters which are not being mutated to safeguar…

a747dee

…d from future risks

improved readable naming conventions for structs and functions

6242298

pinned the indexes for the attributes so that future misplacement of …

7ac3abc

…attributes do not corrupt the migrator and changed data_template_new to create data template as per the requirement (if ip mode then 21 attr otherwise 25)

corrected pos of typedef

e52301e

abhishekgangwar-ntnx force-pushed the abhishek/lmct branch from ffed51e to e52301e Compare May 30, 2026 13:09

abhishekgangwar-ntnx added 2 commits May 30, 2026 14:39

added libuuid req in github workflow

6259092

removed attr_repl_zone and attr_orig_zone for zone based migration as…

89fdabf

… it might lead to inconsistency and wrong result, because there is no separation of zones in our setup thus they are not even required.

changed the enum name to more intutite and readable names but kept th…

2640b86

…e save and load mode enums separate to keep the readability for parameters in several methods

abhishekgangwar-ntnx requested a review from priyankar-jain June 10, 2026 06:22

abhishekgangwar-ntnx added 8 commits June 10, 2026 16:58

added new tests for data_template.c

c68e5c8

added tests for conntrack_entry.c changes, introduced by lmct

953dc5a

added tests for conntrack_store.c

311f2a1

added tests for changes in dbus_server.c

e5853f6

added tests for conntrack.c for changes introduced by LMCT

4bd7e4e

added tests for common.c

a553cf2

added tests for marshal and unmarshal files

fa3c704

added comments in test_marshal.c

707c5da

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[WIP] [FEAT-18702] LMCT - Supporting Zone Based Conntrack Migration#17

[WIP] [FEAT-18702] LMCT - Supporting Zone Based Conntrack Migration#17
abhishekgangwar-ntnx wants to merge 35 commits into
masterfrom
abhishek/lmct

abhishekgangwar-ntnx commented May 15, 2026 •

edited

Loading

Uh oh!

mansish404 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

abhishekgangwar-ntnx commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Command-Line Interface Updates

Zone-Based Filtering & Entry Capture

Zone Remapping on Load

Manual Testing

Note

Uh oh!

mansish404 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

abhishekgangwar-ntnx commented May 15, 2026 •

edited

Loading