netlink: do not ignore vip as system owner

keepalived/core/global_parser.c

@@ -400,6 +400,22 @@ min_auto_priority_delay_handler(const vector_t *strvec)
 
 	global_data->min_auto_priority_delay = delay;
 }
+
+static void
+vrrp_system_owner_handler(const vector_t *strvec)
+{
+
+	if (!strcmp(strvec_slot(strvec, 1), "strict")) {
+		global_data->vrrp_system_owner = 2;
+	}
+	else if (!strcmp(strvec_slot(strvec, 1), "any")) {
+		global_data->vrrp_system_owner = 1;
+	}
+	else {
+		global_data->vrrp_system_owner = 0;
+	}
+}
+
 #ifdef _WITH_VRRP_
 static void
 smtp_alert_vrrp_handler(const vector_t *strvec)
@@ -2301,6 +2317,7 @@ init_global_keywords(bool global_active)
 	install_keyword("shutdown_script_timeout", &shutdown_script_timeout_handler);
 	install_keyword("max_auto_priority", &max_auto_priority_handler);
 	install_keyword("min_auto_priority_delay", &min_auto_priority_delay_handler);
+	install_keyword("vrrp_system_owner", &vrrp_system_owner_handler);
 #ifdef _WITH_VRRP_
 	install_keyword("smtp_alert_vrrp", &smtp_alert_vrrp_handler);
 #endif

keepalived/core/keepalived_netlink.c

@@ -227,8 +227,13 @@ ignore_address_if_ours_or_link_local(struct ifaddrmsg *ifa, struct in_addr *addr
 
 		if (ifa->ifa_family == vrrp->family) {
 			list_for_each_entry(ip_addr, &vrrp->vip, e_list) {
-				if (addr_is_equal2(ifa, addr, ip_addr, ifp, vrrp))
+				if (addr_is_equal2(ifa, addr, ip_addr, ifp, vrrp)) {
+					/* When an instance is owning the
+					 * system IP, do not ignore. */
+					if (vrrp->base_priority == VRRP_PRIO_OWNER)
+						continue;
 					return true;
+				}
 			}
 		}
 
@@ -954,6 +959,17 @@ netlink_if_address_filter(__attribute__((unused)) struct sockaddr_nl *snl, struc
 						 * it might be being promoted from secondary to primary */
 						if (!have_address(addr.in, ifp, AF_INET))
 							if_extra_ipaddress_alloc(ifp, addr.in, AF_INET);
+
+						/* possible transition for
+						 * instances with 255 priority */
+						list_for_each_entry(top, &ifp->tracking_vrrp, e_list) {
+							vrrp = top->obj.vrrp;
+							if (vrrp->base_priority == VRRP_PRIO_OWNER &&
+								vrrp->saddr.ss_family == AF_UNSPEC){
+								addr_chg = true;
+								break;
+							}
+						}
 					}
 				} else {
 					if (IN6_IS_ADDR_UNSPECIFIED(&ifp->sin6_addr)) {
@@ -974,6 +990,17 @@ netlink_if_address_filter(__attribute__((unused)) struct sockaddr_nl *snl, struc
 						 * it might be being promoted from secondary to primary */
 						if (!have_address(addr.in6, ifp, AF_INET6))
 							if_extra_ipaddress_alloc(ifp, addr.in6, AF_INET6);
+
+						/* possible transition for
+						 * instances with 255 priority */
+						list_for_each_entry(top, &ifp->tracking_vrrp, e_list) {
+							vrrp = top->obj.vrrp;
+							if (vrrp->base_priority == VRRP_PRIO_OWNER &&
+								vrrp->saddr.ss_family == AF_UNSPEC){
+								addr_chg = true;
+								break;
+							}
+						}
 					}
 				}
 
@@ -1003,12 +1030,16 @@ netlink_if_address_filter(__attribute__((unused)) struct sockaddr_nl *snl, struc
 						    vrrp->family == ifa->ifa_family &&
 						    vrrp->saddr.ss_family == AF_UNSPEC &&
 						    (!__test_bit(VRRP_FLAG_SADDR_FROM_CONFIG, &vrrp->flags) || is_tracking_saddr)) {
-							/* Copy the address */
-							if (ifa->ifa_family == AF_INET)
-								inet_ip4tosockaddr(addr.in, &vrrp->saddr);
-							else
-								inet_ip6tosockaddr(addr.in6, &vrrp->saddr);
-							try_up_instance(vrrp, false);
+							if (vrrp->base_priority < VRRP_PRIO_OWNER ||
+									vrrp_system_owner_ready(vrrp, ifp)) {
+								/* Copy the address */
+								if (ifa->ifa_family == AF_INET)
+									inet_ip4tosockaddr(addr.in, &vrrp->saddr);
+								else
+									inet_ip6tosockaddr(addr.in6, &vrrp->saddr);
+
+								try_up_instance(vrrp, false);
+							}
 						}
 #ifdef _HAVE_VRRP_VMAC_
 						/* If IPv6 link local and vmac doesn't have an address or we have
@@ -1175,6 +1206,21 @@ netlink_if_address_filter(__attribute__((unused)) struct sockaddr_nl *snl, struc
 					}
 				}
 			}
+			else {
+				/* check for 255 instances */
+				if (!list_empty(&ifp->tracking_vrrp)) {
+					if (h->nlmsg_type == RTM_DELADDR)
+					list_for_each_entry(top, &ifp->tracking_vrrp, e_list) {
+						vrrp = top->obj.vrrp;
+						if (vrrp->base_priority == VRRP_PRIO_OWNER
+							&& vrrp->state != VRRP_STATE_FAULT
+							&& !vrrp_system_owner_ready(vrrp, ifp)){
+							down_instance(vrrp);
+							vrrp->saddr.ss_family = AF_UNSPEC;
+						}
+					}
+				}
+			}
 
 			if (addr_chg) {
 				/* Now we can remove the address */

keepalived/include/global_data.h

@@ -116,6 +116,7 @@ typedef struct _data {
 	unsigned			startup_script_timeout;
 	notify_script_t			*shutdown_script;
 	unsigned			shutdown_script_timeout;
+	unsigned			vrrp_system_owner;
 #ifndef _ONE_PROCESS_DEBUG_
 	const char			*reload_check_config;	/* log file name for validating new configuration before reloading */
 	const char			*reload_time_file;

keepalived/include/vrrp.h

@@ -66,6 +66,9 @@ enum vrrp_flags_bits {
 	VRRP_FLAG_EVIP_OTHER_FAMILY,		/* There are eVIPs of the different address family from the vrrp family */
 	VRRP_FLAG_ALLOW_NO_VIPS,		/* Suppresses warnings re no VIPs */
 	VRRP_FLAG_NOPREEMPT,			/* true if higher prio does not preempt lower */
+	VRRP_FLAG_SYSTEM_OWNER_DFT,		/* system owner instance can transit with any IP address on physical interface */
+	VRRP_FLAG_SYSTEM_OWNER_ANY,		/* system owner instance can transit with any VIP on physical interface */
+	VRRP_FLAG_SYSTEM_OWNER_STRICT,		/* system owner instance can transit with all VIPs on physical interafce */
 #ifdef _HAVE_VRRP_VMAC_
 	VRRP_VMAC_BIT,
 	VRRP_VMAC_UP_BIT,

keepalived/include/vrrp_scheduler.h

@@ -70,6 +70,7 @@ extern void vrrp_gratuitous_arp_thread(thread_ref_t);
 extern void vrrp_lower_prio_gratuitous_arp_thread(thread_ref_t);
 extern void vrrp_arp_thread(thread_ref_t);
 extern void try_up_instance(vrrp_t *, bool);
+extern bool vrrp_system_owner_ready(vrrp_t *, interface_t *);
 #ifdef _WITH_DUMP_THREADS_
 extern void dump_threads(void);
 #endif

keepalived/vrrp/vrrp.c

@@ -4250,17 +4250,22 @@ set_vrrp_src_addr(void)
 					vrrp->saddr.ss_family = AF_UNSPEC;
 				}
 			}
-			else if (vrrp->family == AF_INET)
-				inet_ip4tosockaddr(&VRRP_CONFIGURED_IFP(vrrp)->sin_addr, &vrrp->saddr);
+			else if (vrrp->family == AF_INET) {
+				if(vrrp->base_priority < VRRP_PRIO_OWNER || vrrp_system_owner_ready(vrrp, VRRP_CONFIGURED_IFP(vrrp)))
+					inet_ip4tosockaddr(&VRRP_CONFIGURED_IFP(vrrp)->sin_addr, &vrrp->saddr);
+			}
 			else if (vrrp->family == AF_INET6) {
+				if(vrrp->base_priority < VRRP_PRIO_OWNER ||
+					vrrp_system_owner_ready(vrrp, VRRP_CONFIGURED_IFP(vrrp))) {
 #ifdef _HAVE_VRRP_IPVLAN_
-				if (__test_bit(VRRP_IPVLAN_BIT, &vrrp->flags)) {
-					if (!IN6_IS_ADDR_UNSPECIFIED(&vrrp->ifp->sin6_addr))
-						inet_ip6tosockaddr(&vrrp->ifp->sin6_addr, &vrrp->saddr);
-				} else
+					if (__test_bit(VRRP_IPVLAN_BIT, &vrrp->flags)) {
+						if (!IN6_IS_ADDR_UNSPECIFIED(&vrrp->ifp->sin6_addr))
+							inet_ip6tosockaddr(&vrrp->ifp->sin6_addr, &vrrp->saddr);
+					} else
 #endif
-					if (!IN6_IS_ADDR_UNSPECIFIED(&VRRP_CONFIGURED_IFP(vrrp)->sin6_addr))
-						inet_ip6tosockaddr(&VRRP_CONFIGURED_IFP(vrrp)->sin6_addr, &vrrp->saddr);
+						if (!IN6_IS_ADDR_UNSPECIFIED(&VRRP_CONFIGURED_IFP(vrrp)->sin6_addr))
+							inet_ip6tosockaddr(&VRRP_CONFIGURED_IFP(vrrp)->sin6_addr, &vrrp->saddr);
+				}
 			}
 		}
 	}

keepalived/vrrp/vrrp_parser.c

@@ -1002,6 +1002,15 @@ vrrp_prio_handler(const vector_t *strvec)
 	}
 	else
 		current_vrrp->base_priority = (uint8_t)base_priority;
+
+	if (current_vrrp->base_priority == VRRP_PRIO_OWNER){
+		if (global_data->vrrp_system_owner == 2)
+			__set_bit(VRRP_FLAG_SYSTEM_OWNER_STRICT, &current_vrrp->flags);
+		else if (global_data->vrrp_system_owner == 1)
+			__set_bit(VRRP_FLAG_SYSTEM_OWNER_ANY, &current_vrrp->flags);
+		else
+			__set_bit(VRRP_FLAG_SYSTEM_OWNER_DFT, &current_vrrp->flags);
+	}
 }
 static void
 vrrp_adv_handler(const vector_t *strvec)

keepalived/vrrp/vrrp_scheduler.c

@@ -660,6 +660,59 @@ vrrp_lower_prio_gratuitous_arp_thread(thread_ref_t thread)
 	vrrp_send_link_update(vrrp, vrrp->garp_lower_prio_rep);
 }
 
+bool
+vrrp_system_owner_ready(vrrp_t *vrrp, interface_t *ifp) {
+
+	sin_addr_t *saddr;
+	ip_address_t *ip_addr;
+	bool any;
+
+
+	char addr_str[INET6_ADDRSTRLEN];
+
+	if (__test_bit(VRRP_FLAG_SYSTEM_OWNER_DFT, &vrrp->flags))
+		return true;
+
+	list_for_each_entry(ip_addr, &vrrp->vip, e_list) {
+		any = false;
+		if (vrrp->family == AF_INET) {
+			if (inaddr_equal(AF_INET, &ifp->sin_addr, &ip_addr->u.sin.sin_addr)) {
+				if (__test_bit(VRRP_FLAG_SYSTEM_OWNER_ANY, &vrrp->flags))
+					return true;
+				any = true;
+			}
+			list_for_each_entry(saddr, &ifp->sin_addr_l, e_list) {
+				if (inaddr_equal(AF_INET, &(saddr->u.sin_addr),
+						&ip_addr->u.sin.sin_addr)) {
+					if (__test_bit(VRRP_FLAG_SYSTEM_OWNER_ANY, &vrrp->flags))
+						return true;
+					any = true;
+				}
+			}
+		}
+		else {
+			if (inaddr_equal(AF_INET6, &(ifp->sin6_addr), &(ip_addr->u.sin6_addr))) {
+				if (__test_bit(VRRP_FLAG_SYSTEM_OWNER_ANY, &vrrp->flags))
+					return true;
+				any = true;
+			}
+			list_for_each_entry(saddr, &ifp->sin6_addr_l, e_list) {
+				if (inaddr_equal(AF_INET6, &(saddr->u.sin6_addr), &(ip_addr->u.sin6_addr))) {
+					if (__test_bit(VRRP_FLAG_SYSTEM_OWNER_ANY, &vrrp->flags))
+						return true;
+					any = true;
+				}
+			}
+		}
+
+
+		if (!any && __test_bit(VRRP_FLAG_SYSTEM_OWNER_STRICT, &vrrp->flags))
+			return false;
+	}
+
+	return any;
+}
+
 void
 try_up_instance(vrrp_t *vrrp, bool leaving_init)
 {