From patchwork Mon Jul 27 17:38:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10076 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4h85Sn6ny0z3wnH for ; Mon, 27 Jul 2026 17:39:37 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4h85Sd5MZcz44D for ; Mon, 27 Jul 2026 17:39:29 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4h85RZ3PbLz36Zx for ; Mon, 27 Jul 2026 17:38:34 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4h85RX010rz2xHP for ; Mon, 27 Jul 2026 17:38:32 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4h85RM59G1z45x; Mon, 27 Jul 2026 17:38:23 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1785173903; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tMpPlWkVUdAh41g3C58pJ3HPlcMlgHzy4kP8B5gmedk=; b=D28SJcmXWpO1BY4ocuMZwtoKL/kVRneoVHSIvS7q+CEwBuRWr/drucpZUJK/LY6GLxeRVs gRZPMsFTQAqrFIDw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1785173903; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tMpPlWkVUdAh41g3C58pJ3HPlcMlgHzy4kP8B5gmedk=; b=ide3IKky0NdosS0ZWRhAynT2mC3FJrHwVqWDX42rlKn/8a0K+9LimpFaX732PU97BDJpEN daprZKTtoRzRGxIL4F2g4BwEWf9hXUuX0im5MlQ+SYBzE0ynwM4tdlozUCO2KmaVM4nW9Z 2DUx9SUHmKReubxb4YyZIT/cCv5XG2bpR1BA6MnImJ44VxyPbBS1/US5IZERhdbiGyhTBs mjuzqw4IxmUw1tar/NBLDvp3lr+qHE9LRFkKvpkJlauWcaKtpm6ABjV0/l+Gs9nCX+4wCZ LRNZT9LcaVoTVfyMlNyyABY9/WnKyWmqA/Lmaiz2rauluwDa+NVW7FrqDgcPqg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] keepalived: Update to version 2.4.3 Date: Mon, 27 Jul 2026 19:38:12 +0200 Message-ID: <20260727173812.3673731-2-adolf.belka@ipfire.org> In-Reply-To: <20260727173812.3673731-1-adolf.belka@ipfire.org> References: <20260727173812.3673731-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.3.4 to 2.4.3 - Update of rootfile - Changelog 2.4.3 Improvements vrrp: sign the auth_hmac trailer once per advertisement, so the copies sent to unicast peers share one sequence and HMAC and cost one HMAC per advertisement instead of one per peer. Pointed out by Aditya Dogra. Fixes vrrp: recover the auth_hmac sequence after a corrected clock step. Time mode restarts from the clock once the stored timestamp runs past the freshness window. Monotonic mode keeps strict growth. Pointed out by Aditya Dogra. vrrp: expire an auth_hmac replay mark outside the freshness window, so a receiver stops rejecting a sender that recovered from a step. Monotonic mode keeps its mark. Pointed out by Aditya Dogra. 2.4.2 New vrrp: add a receive-only auth_hmac mode that verifies a present trailer but sends none. A cluster can now migrate receive-only, then permissive, then enforce, with every sweep hitless. permissive on its own risked dual active, since a reloaded node signed toward peers that could not yet verify. Suggested by Aditya Dogra. Fixed vrrp: IPv6 auth_hmac dropped every signed advert. The kernel writes the IPv6 checksum after the trailer is signed, so a receiver that hashed the packet as received never matched the sender. The VRRP checksum and HMAC fields are now read as zero on both sides, which removes the asymmetry, as the IETF draft now specifies. Reported by Aditya Dogra. 2.4.1 Changed vrrp: the auth_hmac sequence number now splits into seconds, a sub-second fraction and a small counter. The sub-second timestamp makes same-instant ties rare, so the previous full width counter is no longer needed. vrrp: order auth_hmac sequences with serial number arithmetic (RFC 1982) and a modular freshness window, so the field wrap is a non-event and no special epoch is required. vrrp: rename the trailer value from MAC to HMAC, since VRRP already uses MAC for the Ethernet address. This renames the related log message, the Invalid HMAC statistic, and the auth_ext_invalid_hmac JSON field. 2.4.0 New vrrp: new auth_hmac authentication extension. It appends an HMAC-SHA256 trailer to each advert, carrying a truncated tag and a time based sequence number, so a receiver can prove an advert came from a holder of the shared key and is fresh. It behaves the same for VRRPv2 and v3, IPv4 and IPv6, unicast and multicast, and it is the recommended protection for unicast where the TTL guard no longer holds. Keys are 32 to 64 bytes, carried inline, read from a file:, or sourced from a systemd encrypted credential, and support make before break rotation. A mode permissive eases migration on a running cluster, and per instance counters report the outcome of each verification. See the VRRP HMAC Authentication article and the keepalived.conf(5) man page. config: add ${_ENV ...} to read values from environment variables, so secrets and host specific values stay out of keepalived.conf. vrrp: add the vrrp_delay_after_boot global keyword, and hold VRRP instances and gratuitous ARP until vrrp_startup_delay expires. check: add an SNMP variable for the number of checkers not run per real server. Security check: fix a heap buffer overflow in the HTTP checker regex partial match, where a crafted server response could overflow the checker buffer. check: fix a stack buffer overflow in set_ping_group_range. parser: resolve a heap buffer overflow, fix an invalid free and a SIGFPE in builtin definitions, and ignore config lines that contain NUL bytes. core: harden parsing of kernel and untrusted input. Bound netlink attribute access and require a kernel origin on netlink messages, bound the /proc stat parse in track_process, validate the BFD event pipe read length, and clamp the SMTP alert body offset. notify: validate the resolved symlink target of scripts and of the notify FIFO, and harden the script execution environment and quoting. dbus: deny keepalived methods by default, validate the object path, and narrow the CreateInstance vrid. vrrp: mask the authentication password in dump and JSON output, wipe HMAC key material after use, validate the VRRPv2 password against the checked length, and bound hardware address and interface name copies. core: abort on out of memory in STRDUP, STRNDUP and REALLOC rather than risk an invalid free, correct JSON string escaping, and set CLOEXEC on the IPVS netlink socket. Improvements www: the keepalived.org website is rebuilt on Material for MkDocs. The former Sphinx user guide is migrated into the new framework, the historical ChangeLog stays available, and the old Sphinx build dependencies and Coverity scaffolding are removed. build: discover OpenSSL through pkg-config, which drives the header checks and the link flags. build: resolve warnings and errors identified by gcc 16. build: portability fixes to configure.ac, using command -v, printf and the = test operator, and avoiding bash substring expansion. snap: stage the libssl3 and libkmod2 packages. github: build keepalived explicitly for CodeQL and bump codeql-action to v4. Fixes vrrp: fix the strict mode check for instances that have unicast peers. vrrp: correct the report of MASTER/BACKUP on the notify FIFO at reload. vrrp: warn when iptables rules cannot be applied, and remove VMAC firewall rules before deleting the link. vrrp: log an error when updating sysctl settings fails, and reset rate-limit flags only after accepting a packet. check: fix an MD5 context leak and a DNS response length check. parser: keep the full 64-bit value in read_unsigned64, fix ${NAME param} substitution when trailing text follows, and handle ~SEQ with a missing close bracket. config: improve parameter substitution, comment stripping and continuation lines, and check PATH_MAX when resolving track file paths. snmp: reject an out of range instance index and fix operator precedence. Signed-off-by: Adolf Belka --- config/rootfiles/packages/keepalived | 1 + lfs/keepalived | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/packages/keepalived b/config/rootfiles/packages/keepalived index b0fbe7363..4c18e2c21 100644 --- a/config/rootfiles/packages/keepalived +++ b/config/rootfiles/packages/keepalived @@ -26,6 +26,7 @@ etc/keepalived/samples #etc/keepalived/samples/keepalived.conf.vrrp.scripts #etc/keepalived/samples/keepalived.conf.vrrp.static_ipaddress #etc/keepalived/samples/keepalived.conf.vrrp.sync +#etc/keepalived/samples/keepalived.service.d.auth_hmac.conf #etc/keepalived/samples/sample.misccheck.smbcheck.sh #etc/keepalived/samples/sample_notify_fifo.sh etc/rc.d/init.d/keepalived diff --git a/lfs/keepalived b/lfs/keepalived index 36c918583..1bc6ac8ca 100644 --- a/lfs/keepalived +++ b/lfs/keepalived @@ -26,7 +26,7 @@ include Config SUMMARY = A keepalive facility for Linux -VER = 2.3.4 +VER = 2.4.3 THISAPP = keepalived-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = keepalived -PAK_VER = 17 +PAK_VER = 18 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 6468cbdd8a5ead443bdb0247ad2a2a7043e20f11c72afa870cded9b52ec23ff98493394aa3fee6e4ece953c85585edcfe76582a13532904cbc29b23f65de7850 +$(DL_FILE)_BLAKE2 = a6e170dfcafc14cb8e556ed575bf7d5adcd1a1762aefcbae22c3d633294be1bd096f7f0992516d5b415ca37d7b710cd6b143b00528b126e9abc4218d7a6c343d install : $(TARGET)