ironcore-dev / ironcore-dev/dpservice
VM can poison conntrack table for a LoadBalancer on another VM
@PlagueCZ is already working on this.
Since Apr 15, 2026.
- Dominant language
- C
- Stars
- 17
- Forks
- 10
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 5
Description
When testing HA situation and needed changes, I noticed that the VM can send any packet to the router (using the default route). Not a problem in itself it seemed.
But this includes a packet that basically looks like a LB response (i.e. from LB IP to some public IP).
If this is done, then after installing a LB target/prefix on another VM on the same host, conntrack will still be using the old flow (the poisoned one) and refuse to communicate properly with the right VM (as it will use the old conntracked one).
There is a pytest in fix/conntrack_poisoning that speaks for itself better.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.