| Message ID | 20260405120354.137211-28-adolf.belka@ipfire.org |
|---|---|
| State | Staged |
| Commit | 7921b9495bad8370a1911b080e0f171055939ee9 |
| Headers |
Return-Path: <development+bounces-1876-patchwork=ipfire.org@lists.ipfire.org> Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4fpWNl2D0Zz3x95 for <patchwork@web04.haj.ipfire.org>; Sun, 05 Apr 2026 12:04:55 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E7" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4fpWNl08MYz5mj for <patchwork@ipfire.org>; Sun, 05 Apr 2026 12:04:55 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4fpWN24cDdz37DC for <patchwork@ipfire.org>; Sun, 05 Apr 2026 12:04:18 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4fpWMs3cxxz36V2 for <development@lists.ipfire.org>; Sun, 05 Apr 2026 12:04:09 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4fpWMr0d2Sz5hQ; Sun, 05 Apr 2026 12:04:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1775390648; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wLbze7aVKJp6PgDIYLin4oIJZN0Du370/Q9Hv6ANqfI=; b=Iz3JgIRRqE3cHHcyO8e7Sdu+OPBJzXd3iWCX3x40Vt3oAUtiVOm6WXZuMGCRlX8R2RqFGg zoAXKVF6YsC72y+u2RLDN8bYmsB8AGRVVWlShwFEfmbte6sK6CmjE71vccg+7VWQW4cfHA X8ZscQlHKdnuHp16CmN5N0PEaYw1xzBMLoi9zR7Kbmsn55ZiErPKKVe9gvLvJkdZKqVx6L ybOtbCngJ0HmbW4MibZ+tbNNoIrP9WXJlhU6asRLT1obqO/hF0ECkK1UYVjpw+PYRZINRZ QMkS5VhY5XqqfA+1MH7EoVyTL32qQTritFtKNFWbHBUZ/TAqDFlO0T4wF4ZvqQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1775390648; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wLbze7aVKJp6PgDIYLin4oIJZN0Du370/Q9Hv6ANqfI=; b=3AOWKcN+l5GvgPn6NwjABT6n7Pw00W/netixUAci6fIz3tI2cDYdfpPSKw9rjJ6FOfmc3/ xFIp9r/6LWtHDmDQ== From: Adolf Belka <adolf.belka@ipfire.org> To: development@lists.ipfire.org Cc: Adolf Belka <adolf.belka@ipfire.org> Subject: [PATCH] keepalived: Update to version 2.3.4 Date: Sun, 5 Apr 2026 14:03:45 +0200 Message-ID: <20260405120354.137211-28-adolf.belka@ipfire.org> In-Reply-To: <20260405120354.137211-1-adolf.belka@ipfire.org> References: <20260405120354.137211-1-adolf.belka@ipfire.org> Precedence: list List-Id: <development.lists.ipfire.org> List-Subscribe: <https://lists.ipfire.org/>, <mailto:development+subscribe@lists.ipfire.org?subject=subscribe> List-Unsubscribe: <https://lists.ipfire.org/>, <mailto:development+unsubscribe@lists.ipfire.org?subject=unsubscribe> List-Post: <mailto:development@lists.ipfire.org> List-Help: <mailto:development+help@lists.ipfire.org?subject=help> Sender: <development@lists.ipfire.org> Mail-Followup-To: <development@lists.ipfire.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit |
| Series |
keepalived: Update to version 2.3.4
|
|
Commit Message
Adolf Belka
5 Apr 2026, 12:03 p.m. UTC
- Update from version 2.3.1 to 2.3.4
- No change to rootfile
- Changelog
2.3.4
Improvements
core: properly restore process priorities after a reload.
core: allow specifying iproute_usr_dir even if no iproute2 support.
core: include network namespace name when error opening namespace fds.
core: resolve lang warning when comparing ordering of function addresses.
The only reason function addresses are compared is with a red-black
tree to quickly convert a function address into its name. It clearlt
isn’t a sandard thing to do to compare ordering of function addresses,
but it this case it is quite valid.
core: stop repeatedly calling getpid(). We only need to call getpid() once
per process, and can then save the value. A PID of a given process is
never going to change!
core: add code to calculate maximum stack usage and use it for no_swap.
When a process has no_Swap specified, if we want to ensure that the
stack is resident in memory we need to know the maximum size that it
is likely to grow to. This commit adds diagnostic code (usually
disabled) to report maximum usage, so that the code can be updated to
know, in advance, the maximum likely stack usage.
core: set CLOEXEC flag on all file descriptors except stdin/stdout/stderr.
core: set CLOEXEC flag on streams (fopen/popen).
snmp: set CLOEXEC on file descriptors opened by snmp.
snmp: use close_range() if available for closing snmp file descriptors.
core: call close_range() if available before exec’ing scripts.
Fixes
build: fix snap build process.
vrrp: fix segfault at reload when DBus re-enabled. If dbus as enabled,
then a reload disabled it, and another reload re-enabled it, then
keepalived would often segfault. This is resolved by clearing
dbus_startup_completed when dbus is stopped.
vrrp: fix track_process warn identified by -Wflex-array-member-not-at-end.
notify: fix resolving group name to gid for scripts. If a group had a
large number of members, the memory allocated for getgrnam_r() could
be insufficient and the call fail. This commit now allocates as much
memory as the size of the group file, which should be sufficient.
ipvs: resolve infinity loop when SMTP_CHECKers have ‘host’ config.
core: fix keepalived not coredumping after a reload. This made it very
difficult to resolve segfaults occurring due to a reload.
vrrp: document and fix specifying iproute_etc_dir and iproute_usr_dir.
build: fix some RHEL 7 and friends compilation problems.
core: fix memory leak in track_file.
2.3.3
New
vrrp: don’t allow unicast instance without interface to have a VMAC. If
the interface is not configured, we can’t know what interface to add
the VMAC to.
vrrp: Add setting IP_FREEBIND/IPV6_FREEBIND socket option. This allows
creating and configuring unicast sockets before the configured source
address is added to the system.
core: add O_CLOEXEC flag to pidfiles.
vrrp: Support logging rate-limiting specified by RFC 9568
vrrp: add option for address owner to drop received VRRP packets.
RFC 9568 (and RFC 5798 and RFC 3768) state that an address owner must
drop any received VRRP packets. The consequence of this is that if
there is more than one VRRP instance configured with priority 255 then
they will all be in master state simultaneously. It seems more
sensible for such received packets to be processed normally, and all
but the VRRP instance with the primary IP address will revert to
backup state. RFC 9568 appears to allow more than one instance to have
priority 255, since section 8.3.2 was changed from “No more than one
router on the link is to be configured with priority 255, especially
if preemption is set” (note the contradiction here) to “only a single
VRRP Router on the link SHOULD be configured with priority 255” and
then descibes the situation if there is more than one such router.
keepalived defaults to processing received packets when the local
priority is 255, but the option added by this patch allows working in
accordance with the RFC, i.e. to drop any received packets.
Improvements
core: Allow building on very old systems with kernels < 3.15. Open file
descriptor locks were introduced in Linux 3.15, so we cannot use that
type of locking on systems with older kernels (e.g. CentOS 7, which of
course is no longer supported). Since this problem only occurs on
kernels no longer supported by keepalived this commit simply removes
the file locking, rather than implementing a more comprehensive
solution. It is expected that at some point, in order to simplify the
code, support for kernels no longer supported by any of the main
distros will be removed from keepalived.
doc: add oldest distro versions with their EOL dates and kernel versions.
docker: Install linux-headers pkg to build in Docker.
vrrp: handle checking ip utility version properly with BusyBox.
snap: Misc snap improvements.
build: make default _FORTIFY_SOURCE setting 3. Various distros already
use _FORTIFY_SOURCE=3 by default, so we should do so too.
vrrp: check the iproute2 directories exist when read first file
vrrp: create /etc/iproute2 directory if it doesn’t exist.
vrrp: Restore priority 255 if duplicate address owner detected. The VRRP
RFCs assume that only one device is configured as the address owned
for any VRID. keepalived has extended functionality which detects if
two (or more) systems are configured as the address owner (this is
completely invalid configuration). To avoid multiple systems acting as
address owner, and hence all of them remaining in master mode,
keepalived will reduce an address owner’s priority to 254 if the other
device configured as address owner does not go away. This commit
restores the priority of a vrrp instance to 255 if it had reduced it
to 254 to avoid multiple VRRP instances simultaneously advertising
that they are the address owner.
vrrp: Only reduce address owner priority if primary ip address lower. If a
VRRP instance is configured as address owner and it detects another
device also advertising it is the address owner, only initially reduce
our priority if our primary IP address is lower than the other
device’s primary IP address.
vrrp: if duplicate address owners, reduce priority if other won’t. If a
VRRP instance is configured as address owner and it detects another
device also advertising it is the address owner, we don’t reduce our
priority if our primary IP address is higher than the other device’s
primary IP address. However, if the other system, with a lower
primary IP address, won’t reduce its priority (e.g. it is not a
keepalived implementation), then we will reduce our priority after a
suitable time.
vrrp: add more helpful log messages if duplicate address owner.
vrrp: log rate-limited message if advert has no VIPs.
vrrp: log rate-limited warning if VRRPv3 advert interval mismatch.
vrrp: it is not an error if VIPs in advert do not match configured. We
should accept a VRRP advert if the VIPs in an advert do not match our
configuration, but just log a rate-limited warning.
vrrp: update saved master address when receive high priority advert. If we
are in master state and receive a higher priority advert, saving the
new master address saves checking VIPs twice.
vrrp: include source address in log after receiving a bad advert.
vrrp: check that VIPs are not duplicated.
vrrp: check TTL/HL and unicast source ip even when not checking VIPs. The
checking of TTL/HL and unicast source ip was only being done if the
VIPs were being checked, whereas they should be checked even if the
VIPs are not being checked.
vrrp: change rx_ttl_hop_limit to rx_ttl_hl. The name was confusing since
it suggested the value was a limit.
vrrp: identify unicast peer in unicast_peer block configuration errors.
vrrp: detect and reject duplicate unicast_peers in configuration.
vrrp: add logging a change of master when detailed logging enabled.
vrrp: handle a reload with no more startup_delay. During the
vrrp_startup_delay time, if keepalived is reloaded with no more
startup_delay, the startup_delay is never timed out and all received
adverts is discarded. The commit causes the startup_delay timer to be
reinstated after a reload with no more startup_delay if the timer has
not yet expired.
vrrp: Skip running not idle vrrp scripts. When a vrrp script is to be run
(initially or after specified interval), first it is checked if it’s
in IDLE state. If not a log message is printed informing about
skipping run due to script being either running or timed out. However
despite not being idle the code continues to run new script process.
In heavily loaded systems this caused running multiple instances of
vrrp script at the same time. This patch brings back missing return,
which was lost during refactoring.
codeQL: update codeQL.yml
vrrp: add checks that interface fault flags not inconsistent. When a fault
is added in down_instance() or cleared in try_up_instance() check that
the flag that is being modified is not already set or cleared, as
appropriate. This check is enabled by configure option
–enable-fault-flags-check.
vrrp: use a fault flag if num_track_faults is non zero. It simplifies the
code to set a fault flag is num_track_faults is non-zero and clear the
flag if num_track_faults is zero.
vrrp: don’t attempt to send advert if socket is closed. This avoids an
unnecessary log message.
vrrp: don’t have multiple tracking objects for a VRRP instance. The code
did have separate tracking objects for dynamic and non dynamic
tracking objects for a VRRP instance. It also would add an addition
dynamic tracking object every time a tracked interface was created,
causing down_instance() to be called multiple times when an interface
was deleted and previous creations of the interface. Prior to the
patch to add fault flag bits this resulted in the vrrp instance not
coming back up after the interface was recreated. Ths issue of vrrp
instances remaining in fault state after after deletion and
re-creation of interfaces is now resolved.
vrrp: delay deleting VMACs are parent interface is deleted. The interface
structure needs to have the ifindex set for the first pass through the
VRRP instances, but it must be unset when the VMACs are cleaned up.
vrrp: don’t change link local IPv6 address when extra added to base if. If
an additional link local address was added to the base interface of a
VMAC, keepalived was changing the source address of adverts to be the
new address. The commit makes keepalived change the source address if
the one it is using is deleted.
track: don’t overwrite track file at startup unless configured to.
vrrp: allow interface up debounce timer to exceed 2 * advert interval.
There was no need to limit the up debounce timer in the same way that
the down debounce timer has to be limited, so this commit removes the
2 * advert interval upper limit.
vrrp: update delayed start time on reload if vrrp_startup_delay changed.
vrrp: ignore IPv6 tentative addresses. We can’t do anything with them, and
they are not usable, so we now wait until we are notified that the
address is no longer tentative before we consider using it.
Fixes
parser: Fix error handling for HEX_STR parsing in UDP_CHECK. Fixes an
issue where HEX_STR values with a trailing 0xff were incorrectly
treated as errors. This HEX_STR is used in UDP_CHECK configuration,
particularly in the payload and require_reply fields.
ipvs: Fix segfault when using track_file checker.
ipvs: Fix delay_loop for TCP_CHECK.
scheduler: Fix segfault caused double erase from child_pid rbtree. In a
situation when a child was timed out, but not yet processed, the
thread is THREAD_CHILD_TIMEOUT type and remains on ready queue. If it
gets terminated in this state, it needs to be removed from rb tree
child_pid and transitioned to THREAD_CHILD_TERMINATED, but without
additional moving it to ready queue as it is already there. The erase
from child_pid tree is required to clean up pid from not terminated
childs tree, but it needs to be done exactly once as rb tree
implementation is not guarded against double removal. Erasing or
adding same element multiple times, leads to malformed red-black tree
and segmentation faults. This patch removes double erase in described
scenario.
build: fix compilation failure if building without VMACs.
vrrp: fix reading of iproute2 conf files when directories don’t exist.
vrrp: fix segfault when instance has no interface configured. If a vrrp
instance has no interface configured (so it is unicast), processing
SIGUSR1 resulted ina segfault.
vrrp: Don’t segfault if open_sockpool_socket() fails to open sockets. If a
unicast VRRP instance is configured and the unicast_src_ip does not
exist on the system, then the bind() fails and the sockets are not
opened. This commit ensures that in that case vrrp->sockets is not
dereferenced. This is not a real fix to the problem. We need to track
the addition and removal of unicast_src_ip addresses, and enter fault
state if the address in not configured, or when it is removed.
vrrp: interface add should call setup_interface(). When an interface is
(re-)added, setup_interface() should be called even if vrrp->flags is
set (eg VRRP_FLAG_NOPREEMPT).
vrrp: fix recreating a VMAC interface with IPv6. The sin6_scope_id was not
being updated if a VMACs underlying interface were deleted and
recreated, causing the bind() call to fail. This commit now correctly
updates the sin6_scope_id field in mcast_daddr.
vrrp: fix persistent FAULT state with use_vmac when interfaces renamed. If
an existing base interface of a VMAC is renamed, delete the VMAC since
the configure base interface no longer exists. When an existing
interface is renamed to match the base interface for a VMAC for a VRRP
instance, for IPv6 when the VMAC interface is created a link local
address is added, so clear the NO_ADDRESS fault flag by calling
try_up_instance(). For IPv4 we do not add an address to the VMAC when
it is created, so will wait for notlink notifications of addresses on
the base interface, which can then be added to be VMAC.
vrrp: fix keepalived warning of ipsets specified without iptables.
keepalived was warning that using ipsets had been specified but
iptables had not been specified, even if ipsets had not been specified.
2.3.2
New
all: add –ignore-sigint option. This is needed for running keepalived
under GDB (see https://bugzilla.kernel.org/show_bug.cgi?id=9039#c8).
vrrp: allow specifing interval amd timeout to milli-second resolution.
Although running track_scripts too rapidly can have use cause heavy
system load, there are use cases for being able to run scripts more
frequently than 1 second, and also at intervals not in whole seconds.
This commit adds the option to be able to specify the interval and
timeout timers to a resolution in milli-seconds.
Improvements
vrrp: remove need for route to have configured interface to track it. If a
virtual route did not have an interface configured, keepalived would
log a warning saying that it could not track the route, and then would
disable tracking of that route. It appears that it is not necessary to
know the interface in order to track the route, and in any event the
netlink message received after adding the route identifies the
interface for the route if it is appropriate. So this commit removes
the requirement to specify an interface in order to track a route.
intall: Update INSTALL instructions - add openSUSE.
ipvs: Retry ipvs_nl_send_message() in ipvs_getinfo(). If we have to call
keepalived_modprobe() for the ip_vs module, on some distros (e.g.
RHEL based ones but not Fedora) we need to call ipvs_nl_send_message()
twice in ipvs_getinfo(), since the first call fails. On most distros
keepalived_modprobe() does not need to be called, since calling
genl_ctrl_resolve(sock, IPVS_GENL_NAME) loads the ip_vs module.
core: improve error message for process event listen.
all: Properly handle an include file name ending with ‘’.
vrrp: Allow for Ethernet frame padding for short packets. Some network
interface cards do not strip Ethernet frame padding before passing a
packet to userspace (recvmesg()). keepalived checks the received
packet length but wasn’t allowing for extra bytes to be received that
were added as frame padding. This commit allows for frame padding to
be received and not report an incorrect packet length.
vrrp: Remove duplicate dumping of master advert interval. Don’t write
master advert interval in keepalived.data twice when using VRRPv3 and
the VRRP instance is in backup state.
vrrp: Handle empty ipset names with vrrp_ipsets keyword. We now handle
empty ipset names and return a config error.
vrrp: handle empty iptables chain names - vrrp_iptables keyword. We now
return an error if a chain name is empty.
vrrp-ipvs: handle empty nftables chain names. We now return an error if a
chain name is empty.
vrrp: use configured vrrp ipset names rather than ignore them.
vrrp: check configured vrrp ipset names are all different. If a pair of
configured ipset names are the same, there will be an error when using
the ipsets. This commits checks and logs an error if two ipset names
are the same.
core: remove some duplicate include files.
core: ensure only one instance of keepalived can run per config_id. There
was a window when keepalived starts up when if two (or more) instances
were starting at the same time, they might not detect the other
instance is running. This commit add advisort file locking on the PID
files to ensure that only one instance can run at a time.
vrrp: Duplicate/drop MLDv1 listener reports on VMACs. MLDv2 listener
reports were being handled, but not MLDv1. This commit now adds
handling of MLDv1 listener reports as well.
all: Ensure pid file exists when respawning child process. If a child
process is respawned, the old pidfile may or may not still exist. If
it doesn’t exist, we need to recreate it. If it still exists we need
to reset our file offset and truncate the file before re-wrighting it.
all: better pidfile handling after reload.
vrrp: add thread_timer_expired keyword as a synonym of
timer_expired_backup. The release notes referred to
thread_timer_expired, so it is added for completeness but logs a
message to change the keyword to timer_expired_backup.
bfd: use time_t to avoid implicit ptr type casting. This fixes an
incompatible pointer type [-Wincompatible-pointer-types] issue when
compiling keepalived with GCC 14 [1] in 32-bit architectures where
time_t size is 64 bits.
vrrp-ipvs: Stop setting SO_LINGER on TCP sockets. Setting SO_LINGER causes
the close() call to block until the first of: 1. the ACK of the FIN is
received 2. the SO_LINGER timeout expires Since the SO_LINGER timeout
was set to 5 seconds, if the FIN or the subsequent ACK were lost, then
keepalived would block for 5 seconds, which must not be allowed to
happen. The only TCP sockets that keepalived opens are for TCP_CHECK,
HTTP_GET, SSL_GET, SMTP_CHECK and sending notify emails. For all of
these, for any data that keepalived sends it receives data in
response, and so there is no purpose in using SO_LINGER. Removing
setting SO_LINGER will stop the occasional ‘A thread timer expired
5.1nnnnn seconds ago’, as reported in issue #2271.
all: use correct format specifier for time fields. 32 bit Debian uses a 32
bit TIMESIZE, whereas 32 bit Ubuntu uses a 64 bit TIMESIZE. This means
that on 32 bit Ubuntu some time types need to be printed using “%lld”,
whereas on 32 bit Debian, and on 64 bit systems “%ld” is what is
needed. Using the wrong format specifier was causing compilation
warnings on 32 bit Debian. The issue impacts printing time_t, struct
timeval tv_sec and tv_usec and struct timespec tv_sec fields.
Peversely, on a 32 bit system when TIMESIZE is 64, struct timeval
tv_usec is 64 bits, whereas struct timesec tv_nsec is 32 bits. The
commit adds configure time checking of the right format specifiers to
use, and adds definitions PRI_time_t, PRI_tv_sec, PRI_ts_sec etc.
core: update addattr_l to match current iproute2 code - almost. The
alignment calculations were not coerect, so this commit updates
addattr_l to match the iproute2 version, EXCEPT there appears to be 1
issue in the iproute2 code when NLMSG_ALIGN is used when RTA_ALIGN
should be used. The difference is entirely cosmetic (at the moment)
since the functionality of the 2 macros is currently identical.
lib: add micro-second timers to memory allocation debugging. Previously
the time was logged for memory allocation/freeing operations in
seconds. When comparing when memory was allocated/freed to debugging
logging via a log file, it was helpful, in terms of being able to
identify the sequence of events, to have the time of memory
allocations etc logged in micro-seconds.
vrrp: on reload only configured track_script name was checked. On a
reload, only the configured name of a track_script was being checked
to see if the new config track_script matched the old config
track_script. If the script to be executed were changed, but the
configured named of the script were kept the same, then the status of
the old script would be transferred to the new script, despite the
scripts being completely different. This commit now checks that the
script really is the same, in terms of the path, parameters and user
executing the script.
vrrp: On reload with addresses added to VRRP instance send 2nd GARPs. If
garp_master_delay is non zero, then after a reload when VIPs are added
to a VRRP instance in master state, as well as the initial block of
GARP messages that are sent, the messages need to be repeated after
garp_master_delay seconds. This commit adds sending the second block.
vrrp: merge vrrp instance garp_pending and gna_pending flags. Combine
garp_pending and gna_pending flags into a single flags; that is all
that is necessary and simplifies the code.
vrrp: Use timer threads for delayed sending of GARPs/GNAs. Previously
whenever a VRRP instance send an advert, it checked to see if any more
GARPs/GNAs were due to be sent, either for garp_master_delay or
garp_master_refresh. Using timer threads removes the checking every
time an advert is sent, and the relevant code is only triggered when a
timer expires.
vrrp: stop using alloc_strvec() for parsing rttables files. It was a good
idea at the time, but is not really appropriate. The parsing can be
done just as simply without using alloc_strvec().
all: stop “unmatched quotes” warning for quoted strings. If a line with a
quoted string has unbalanced quote characters when parsed as a
standard (not quoted) string, an innapropriate warning was issued for
unmatches quotes. This commit now stops the warning. This commit is
not elegant, and it would be appreciated if a neater solution could be
found. If anyone has a better solution, please submit a pull request
or raise an issue explaining the solution.
all: change checking process name at reload to include not NULL checks.
The code was using the reload variable as an indicator that
prev_global_data was not NULL, and this was causing some static code
analysers to to flag up NULL pointer dereferences. The patch
explicitly checks whether prev_global_data is NULL or not, since this
is synonymous with testing the reload variable.
all: clear pointers to old data structures freed after reload. This means
that if that if there is a subsequent reference to the old data via
thoe old_global_data, or old{bfd,check,vrrp} pointers, it should cause
a segfault rather than undefined behaviour. It will also make it more
straightford to debug any problem should it occur.
vrrp: update location of iproute config files. Since iproute2 version 3.3
the location of the config files has been configurable, with the
default being /etc/iproute2. Since version 4.4 there has been an
rt_tables.d sub-directory. Version 4.10 added an rt_protos.d
sub-directory, and version 6.5 added a second directory
(/usr/lib/iproute2 or /usr/lib64/iproute) which 6.7 changed to
/usr/share/iproute2 as the default. No major distro appears to change
the default locations, and the only distro that used verion 6.5 or 6.6
was Fedora 40, but that has now upgraded to 6.7 so we are not bothered
with the /usr/lib* options. The two directories have configure
options, and if they are not specified, configure attempts to get the
locations from the ip-route man page or the ip executable.
vrrp: Specify protocol for IP addresses that keepalived adds. This is
similar to being able to specify a protocol of ip routes and rules.
vrrp: Add configure option to update /etc/rt_addrprotos. If there is no
keepalived entry in rt_addrprotos create an entry which is removed
when keepalived terminates. This will allow ip address show to display
the protocol of an address as “keepalived” rather than 0x12.
vrrp: always add a keepalived entry to rt_addrprotos is none exists.
doc: Some updates.
Fixes
vrrp: Handle a reload before vrrp_delayed_start has expired. If
keepalived reloaded its configuration before a specified
vrrp_startup_delay had expired, the startup_delay was never being
timed out, and so all received adverts would be discarded. The commit
caused the startup_delay timer to be reinstated after a reload if the
timer has not yet expired.
ipvs: Update status code of misc checker if changes while in fault state.
The exit code of a misc checker can be read via SNMP. The misc check
code was not updating the last exit code if the checker was not
dynamic, the checker was already down (i.e. returned a non 0 exit
code), and the exit code changed from the previous exit code. This
meant that the exit code reported via SNMP was not the latest exit
code, but the exit code that caused the status of the checker to
change. This commit now updates the last exit code, even if the
checker is already down.
vrrp: Ensure VRRPv3 advert interval strictly <= 40.95 seconds. If an
advert interval of 40.958 seconds was configured, it was being round
up to 40.96 after the check that the advert interval was less than
40.96. The consequence of this was that adverts were being sent at
40.96 second intervals, but worse, the advert interval in the VRRP
packet was set to 0. This commit now ensures that after the rounding
the advert interval is <= 40.95 seconds.
vrrp: fix track process reinitialize fork delay timer. Github user
Bbulatov identified that terminate_delay was being used when
fork_delay should have been used. While investigating, it was also
found, albeit in a debug message that fork_delay was used where
terminate_delay should have been used. Further, the process state was
being updated immediately even if the fork_delay was being invoked.
vrrp: fix memory leak if error in vrrp_ipsets configuration.
vrrp: stop memory leak when error in configuring vrrp_iptables.
bfd: make alloc_bfd() return NULL rather than false on error. alloc_bfd()
returns a bfd_t *, but in the case of errors it was returning false,
which clearly should have been NULL. This issues was identified by
compiling with -std=c23.
vrrp: fix corruption of master-child_pid red black tree. Child process
thread_t structures use two red-black trees, one for the timeout, and
the other for pids. It is important to ensure that threads are removed
from the child_pid RB tree at the correct time. This was not happening
when reloads were occurring and there was a THREAD_CHILD_TIMEOUT
thread on the ready list. A few other instances of the thread not
being removed from the child_pid RB tree correctly, which are also
resolved by this commit.
all: Fix parsing of xNN in quoted strings. Following x keepalived
processed all following hex digits, but only returned one byte. For
example x20file would result in a byte 0x0f followed by the string
“ile”. This commit limits the number of hex digits consumed to 2.
all: fix parsing of escaped characters in quoted strings.
core: fix error report in json version parser.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
lfs/keepalived | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/lfs/keepalived b/lfs/keepalived index ed1ad87d3..36c918583 100644 --- a/lfs/keepalived +++ b/lfs/keepalived @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info@ipfire.org> # +# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = A keepalive facility for Linux -VER = 2.3.1 +VER = 2.3.4 THISAPP = keepalived-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = keepalived -PAK_VER = 16 +PAK_VER = 17 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f4e0de6147f0a33d2d87f12da4dda014fa820ba3502fd8f92eaaa4a8e56d26ea4bb1902df5c7ee13e4b81336e3b237d1ddc8247e443ea351646259c9e1ddb90b +$(DL_FILE)_BLAKE2 = 6468cbdd8a5ead443bdb0247ad2a2a7043e20f11c72afa870cded9b52ec23ff98493394aa3fee6e4ece953c85585edcfe76582a13532904cbc29b23f65de7850 install : $(TARGET)