Conntrack: Firewall reconciliation process-owned&transactional

src/maestro/shutdown.rs

@@ -23,6 +23,7 @@ use super::control_plane::ProcessControlPlane;
 use super::generation::RuntimeGeneration;
 use super::helpers::{format_uptime, unit_label};
 use super::reload_supervisor::ReloadSupervisorHandle;
+use crate::conntrack_control::FirewallAuthority;
 use crate::quota_state::QuotaStateOwner;
 use crate::stats::Stats;
 use crate::synlimit_control;
@@ -54,6 +55,7 @@ pub(crate) async fn wait_for_shutdown(
     active_runtime: Arc<ArcSwap<RuntimeGeneration>>,
     quota_state: Arc<QuotaStateOwner>,
     reload_supervisor: ReloadSupervisorHandle,
+    conntrack_firewall: Option<FirewallAuthority>,
     process_control_plane: ProcessControlPlane,
 ) {
     let signal = wait_for_shutdown_signal().await;
@@ -63,6 +65,7 @@ pub(crate) async fn wait_for_shutdown(
         active_runtime,
         quota_state,
         reload_supervisor,
+        conntrack_firewall,
         process_control_plane,
     )
     .await;
@@ -95,6 +98,7 @@ async fn perform_shutdown(
     active_runtime: Arc<ArcSwap<RuntimeGeneration>>,
     quota_state: Arc<QuotaStateOwner>,
     reload_supervisor: ReloadSupervisorHandle,
+    conntrack_firewall: Option<FirewallAuthority>,
     process_control_plane: ProcessControlPlane,
 ) {
     let shutdown_started_at = Instant::now();
@@ -126,6 +130,12 @@ async fn perform_shutdown(
         warn!("ME shutdown: pool lifecycle deadline expired");
     }
 
+    if let Some(conntrack_firewall) = conntrack_firewall
+        && !conntrack_firewall.shutdown_and_clear().await
+    {
+        warn!("Conntrack firewall cleanup did not complete successfully");
+    }
+
     if let Err(error) = synlimit_control::clear_synlimit_rules_all_backends().await {
         warn!(error = %error, "Failed to clear SYN limiter rules during shutdown");
     }