From edc71b19c619fdc1d71df10a2d0e8f5822965d69 Mon Sep 17 00:00:00 2001 From: Quentin Armitage Date: Tue, 8 Feb 2022 14:58:49 +0000 Subject: [PATCH] vrrp: nft didn't support meta l4proro until Linux 3.14 For Linux 3.13 (first version to support nftables), we instead specify: @nh,48,8 58 Signed-off-by: Quentin Armitage [Retrieved (and updated to drop update of README.kernel_versions) from: https://github.com/acassen/keepalived/commit/edc71b19c619fdc1d71df10a2d0e8f5822965d69] Signed-off-by: Fabrice Fontaine --- README.kernel_versions | 1 + configure.ac | 5 +++++ keepalived/vrrp/vrrp_nftables.c | 16 ++++++++++++++-- 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 350a9f4e9..bc643dbf1 100644 --- a/configure.ac +++ b/configure.ac @@ -1754,6 +1754,11 @@ if test .${enable_nftables} != .no; then ],[ AC_MSG_RESULT(no) ]) + + # nft l4proto from Linux 3.14 + AC_CHECK_DECLS([NFT_META_L4PROTO], [], [], + [#include ]) + # nft dup from Linux 4.3 AC_CHECK_DECLS([NFTA_DUP_MAX], [], [], [#include ]) diff --git a/keepalived/vrrp/vrrp_nftables.c b/keepalived/vrrp/vrrp_nftables.c index d3ea39db3..8b5095ad4 100644 --- a/keepalived/vrrp/vrrp_nftables.c +++ b/keepalived/vrrp/vrrp_nftables.c @@ -1191,6 +1191,8 @@ setup_rule_move_igmp(uint8_t family, const char *table, otherwise: nft add rule ip keepalived out ip protocol igmp [meta oifkind macvlan] oif @vmac_set drop nft add rule ip6 keepalived out icmpv6 type mld2-listener-report [meta oifkind macvlan] oif @vmac_set drop + * + * Note: on 3.13 kernels, icmpv6 is specified as @nh,48,8 58 */ struct nftnl_rule *r = NULL; uint64_t handle_num; @@ -1223,7 +1225,12 @@ setup_rule_move_igmp(uint8_t family, const char *table, offsetof(struct iphdr, daddr), sizeof(struct in_addr)); #endif } else { - add_meta(r, NFT_META_L4PROTO, NFT_REG_1); +#if HAVE_DECL_NFT_META_L4PROTO + add_meta(r, NFT_META_L4PROTO, NFT_REG_1); /* From Linux 3.14 */ +#else + add_payload(r, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1, + offsetof(struct ip6_hdr, ip6_nxt), sizeof(((struct ip6_hdr *)NULL)->ip6_nxt)); +#endif protocol = IPPROTO_ICMPV6; add_cmp(r, NFT_REG_1, NFT_CMP_EQ, &protocol, sizeof(protocol)); add_payload(r, NFT_PAYLOAD_TRANSPORT_HEADER, NFT_REG_1, @@ -1279,7 +1286,12 @@ setup_rule_drop_router_solicit(const char *table, const char *chain, nftnl_rule_set_u64(r, NFTNL_RULE_POSITION, handle_num); } - add_meta(r, NFT_META_L4PROTO, NFT_REG_1); +#if HAVE_DECL_NFT_META_L4PROTO + add_meta(r, NFT_META_L4PROTO, NFT_REG_1); /* From Linux 3.14 */ +#else + add_payload(r, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1, + offsetof(struct ip6_hdr, ip6_nxt), sizeof(((struct ip6_hdr *)NULL)->ip6_nxt)); +#endif protocol = IPPROTO_ICMPV6; add_cmp(r, NFT_REG_1, NFT_CMP_EQ, &protocol, sizeof(protocol)); add_payload(r, NFT_PAYLOAD_TRANSPORT_HEADER, NFT_REG_1,